At (Linux)

How At Works and Why It Matters

At is a Linux scheduling utility for running a command once at a specified time. Unlike recurring schedulers, it is built for one-time execution, which makes it useful for deferred maintenance, follow-up actions, and timed administrative tasks.

The security significance comes from the fact that a scheduled command can execute later, outside the original change window and sometimes outside normal interactive monitoring. That gap between submission and execution is what makes at attractive for persistence and delayed payload delivery.

Execution Model and Operational Context

An at job is created with a user context, stored in the at spool, and then executed by the system at the scheduled moment. The runtime identity, environment, and path resolution at execution time all matter because the command may behave differently than it did when submitted.

This makes the control surface broader than the command itself. Administrators need to understand who can submit jobs, which accounts are allowed to use the service, and how the system records the submission and execution lifecycle.

Security Implications of Scheduled One-Time Jobs

Because at can launch a command later, it can be abused to delay malicious activity, stage persistence, or separate the initial compromise from the visible impact. That delay can help attackers avoid immediate detection and create a false sense that the environment is clean after the original intrusion.

Defensive review should therefore focus on both the job contents and the surrounding conditions, including unusual submission timing, unexpected user ownership, and commands that invoke shells, downloaders, or privilege-sensitive tooling. Monitoring at-related activity is part of broader auditability and execution control, not just job housekeeping.

Auditing and Control Expectations

Defenders should treat at as a privileged scheduling surface and keep tight visibility over who can submit jobs. Restricting access, reviewing the at spool regularly, and correlating scheduled execution with system logs helps distinguish legitimate deferred work from abuse.

When at is used legitimately, the command intent should be clear, the owning account should be expected, and the execution window should align with known operational change. When those conditions are absent, the job should be investigated as a potential persistence or delayed execution mechanism.

Risk and Threat Considerations

At creates a delayed-execution path that can be abused to survive initial containment or to trigger malicious activity after defenders stop watching the original event. That makes it a practical persistence mechanism on systems where scheduled command submission is weakly governed.

Failure mechanism: An attacker with command execution or local access submits an at job that runs later under a chosen account or environment, bypassing immediate scrutiny and using normal scheduling behavior as cover.

Impact: The system can execute unwanted commands after the initial compromise, extending dwell time, enabling follow-on actions, and complicating incident timelines and remediation.

Practitioner Guidance

What to watch for: Prioritise unexpected at submissions, jobs owned by unusual users, commands that retrieve or unpack additional payloads, and jobs scheduled outside normal administrative patterns. Those are often stronger signals than the presence of the scheduler itself.

Governance implication: Treat at permissions as a controlled capability, not a convenience feature, and make ownership of the service explicit in operating procedures. If the environment cannot support reliable review of scheduled one-time jobs, it should not allow broad submission rights.

Related resources from NHI Mgmt Group

• How should teams respond to a local Linux privilege escalation flaw in shared environments?
• How should security teams handle weak credentials on exposed Linux services?
• How can teams spot proxy abuse on compromised Linux systems?
• How should security teams govern SSH certificates in Linux environments?