Identifier / Programs / Linux and Unix
at
Execute commands once at a later time. Results will be sent to the users mail. tldr-pages
GTFOBins command, shell 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands
How at is abused
command
now
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for at.
2 documented commands
command unprivileged, with sudo
echo /path/to/command | at nowTrips 1 Sigma rule: lowScheduled Task/Job At by Ömer Günal, oscd.community
shell unprivileged, with sudo
tail is used to pause the terminal.
echo "/bin/sh <$(tty) >$(tty) 2>$(tty)" | at now; tail -f /dev/nullTrips 1 Sigma rule: lowScheduled Task/Job At by Ömer Günal, oscd.community
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for at. The identifier reads the line of each that runs at.
What detects it
Everyday use
Create commands interactively and execute them in 5 minutes (press <Ctrl d> when done)
at now + 5 minutesIdentifyTrips 1 Sigma rule: lowScheduled Task/Job At by Ömer Günal, oscd.community
Matches GTFOBins abuse: command
Create commands interactively and execute them at a specific time
at hh:mmIdentifyTrips 1 Sigma rule: lowScheduled Task/Job At by Ömer Günal, oscd.community
Execute a command from stdin at 10:00 AM today
echo "command" | at 1000IdentifyTrips 1 Sigma rule: lowScheduled Task/Job At by Ömer Günal, oscd.community
Of the 3 examples the identifier reads, 3 match GTFOBins abuse or trip a Sigma process-creation rule.