T1053.001SubTechniqueexecutionpersistenceprivilege-escalationrevokedagent-callable

T1053.001At (Linux)

Sub-technique of T1053

Platforms: Linux

ATT&CK version: 14.1

What it is

Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux) An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account. Adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via <code>sudo</code>.(Citation: GTFObins at)

ATT&CK tactics· 3

ExecutionPersistencePrivilege Escalation

References

  1. https://attack.mitre.org/techniques/T1053/001
  2. https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
  3. https://gtfobins.github.io/gtfobins/at/
  4. https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/
Sourced from MITRE ATT&CK Enterprise v14.1. Curated and contextualized for EU compliance use cases by Adam Lundqvist, Founder at SQUR.
T1053.001: At (Linux) | SQUR Knowledge Base