{
	"id": "5968c335-d1a1-4501-a873-85ee9c58661b",
	"created_at": "2026-04-06T01:31:25.621129Z",
	"updated_at": "2026-04-10T13:12:20.254521Z",
	"deleted_at": null,
	"sha1_hash": "b97eb28ac7e4554d6b0b0aa994db1250ed58c541",
	"title": "at(1p) - Linux manual page",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 101514,
	"plain_text": "at(1p) - Linux manual page\r\nArchived: 2026-04-06 01:13:09 UTC\r\nAT(1P) POSIX Programmer's Manual AT(1P)\r\nPROLOG         top\r\n This manual page is part of the POSIX Programmer's Manual. The\r\n Linux implementation of this interface may differ (consult the\r\n corresponding Linux manual page for details of Linux behavior), or\r\n the interface may not be implemented on Linux.\r\nNAME         top\r\n at — execute commands at a later time\r\nSYNOPSIS         top\r\n at [-m] [-f file] [-q queuename] -t time_arg\r\n at [-m] [-f file] [-q queuename] timespec...\r\n at -r at_job_id...\r\n at -l -q queuename\r\n at -l [at_job_id...]\r\nDESCRIPTION         top\r\n The at utility shall read commands from standard input and group\r\n them together as an at-job, to be executed at a later time.\r\n The at-job shall be executed in a separate invocation of the\r\n shell, running in a separate process group with no controlling\r\n terminal, except that the environment variables, current working\r\n directory, file creation mask, and other implementation-defined\r\n execution-time attributes in effect when the at utility is\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 1 of 14\n\nexecuted shall be retained and used when the at-job is executed.\r\n When the at-job is submitted, the at_job_id and scheduled time\r\n shall be written to standard error. The at_job_id is an identifier\r\n that shall be a string consisting solely of alphanumeric\r\n characters and the \u003cperiod\u003e character. The at_job_id shall be\r\n assigned by the system when the job is scheduled such that it\r\n uniquely identifies a particular job.\r\n User notification and the processing of the job's standard output\r\n and standard error are described under the -m option.\r\n Users shall be permitted to use at if their name appears in the\r\n file at.allow which is located in an implementation-defined\r\n directory. If that file does not exist, the file at.deny, which\r\n is located in an implementation-defined directory, shall be\r\n checked to determine whether the user shall be denied access to\r\n at. If neither file exists, only a process with appropriate\r\n privileges shall be allowed to submit a job. If only at.deny\r\n exists and is empty, global usage shall be permitted. The at.allow\r\n and at.deny files shall consist of one user name per line.\r\nOPTIONS         top\r\n The at utility shall conform to the Base Definitions volume of\r\n POSIX.1‐2017, Section 12.2, Utility Syntax Guidelines.\r\n The following options shall be supported:\r\n -f file Specify the pathname of a file to be used as the source\r\n of the at-job, instead of standard input.\r\n -l (The letter ell.) Report all jobs scheduled for the\r\n invoking user if no at_job_id operands are specified. If\r\n at_job_ids are specified, report only information for\r\n these jobs. The output shall be written to standard\r\n output.\r\n -m Send mail to the invoking user after the at-job has run,\r\n announcing its completion. Standard output and standard\r\n error produced by the at-job shall be mailed to the user\r\n as well, unless redirected elsewhere. Mail shall be sent\r\n even if the job produces no output.\r\n If -m is not used, the job's standard output and\r\n standard error shall be provided to the user by means of\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 2 of 14\n\nmail, unless they are redirected elsewhere; if there is\r\n no such output to provide, the implementation need not\r\n notify the user of the job's completion.\r\n -q queuename\r\n Specify in which queue to schedule a job for submission.\r\n When used with the -l option, limit the search to that\r\n particular queue. By default, at-jobs shall be scheduled\r\n in queue a. In contrast, queue b shall be reserved for\r\n batch jobs; see batch. The meanings of all other\r\n queuenames are implementation-defined. If -q is\r\n specified along with either of the -t time_arg or\r\n timespec arguments, the results are unspecified.\r\n -r Remove the jobs with the specified at_job_id operands\r\n that were previously scheduled by the at utility.\r\n -t time_arg\r\n Submit the job to be run at the time specified by the\r\n time option-argument, which the application shall ensure\r\n has the format as specified by the touch -t time\r\n utility.\r\nOPERANDS         top\r\n The following operands shall be supported:\r\n at_job_id The name reported by a previous invocation of the at\r\n utility at the time the job was scheduled.\r\n timespec Submit the job to be run at the date and time specified.\r\n All of the timespec operands are interpreted as if they\r\n were separated by \u003cspace\u003e characters and concatenated,\r\n and shall be parsed as described in the grammar at the\r\n end of this section. The date and time shall be\r\n interpreted as being in the timezone of the user (as\r\n determined by the TZ variable), unless a timezone name\r\n appears as part of time, below.\r\n In the POSIX locale, the following describes the three\r\n parts of the time specification string. All of the\r\n values from the LC_TIME categories in the POSIX locale\r\n shall be recognized in a case-insensitive manner.\r\n time The time can be specified as one, two, or four\r\n digits. One-digit and two-digit numbers shall\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 3 of 14\n\nbe taken to be hours; four-digit numbers to be\r\n hours and minutes. The time can alternatively\r\n be specified as two numbers separated by a\r\n \u003ccolon\u003e, meaning hour:minute. An AM/PM\r\n indication (one of the values from the am_pm\r\n keywords in the LC_TIME locale category) can\r\n follow the time; otherwise, a 24-hour clock\r\n time shall be understood. A timezone name can\r\n also follow to further qualify the time. The\r\n acceptable timezone names are implementation-\r\n defined, except that they shall be case-\r\n insensitive and the string utc is supported to\r\n indicate the time is in Coordinated Universal\r\n Time. In the POSIX locale, the time field can\r\n also be one of the following tokens:\r\n midnight Indicates the time 12:00 am (00:00).\r\n noon Indicates the time 12:00 pm.\r\n now Indicates the current day and time.\r\n Invoking at \u003cnow\u003e shall submit an\r\n at-job for potentially immediate\r\n execution (that is, subject only to\r\n unspecified scheduling delays).\r\n date An optional date can be specified as either a\r\n month name (one of the values from the mon or\r\n abmon keywords in the LC_TIME locale category)\r\n followed by a day number (and possibly year\r\n number preceded by a comma), or a day of the\r\n week (one of the values from the day or abday\r\n keywords in the LC_TIME locale category). In\r\n the POSIX locale, two special days shall be\r\n recognized:\r\n today Indicates the current day.\r\n tomorrow Indicates the day following the\r\n current day.\r\n If no date is given, today shall be assumed if\r\n the given time is greater than the current\r\n time, and tomorrow shall be assumed if it is\r\n less. If the given month is less than the\r\n current month (and no year is given), next\r\n year shall be assumed.\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 4 of 14\n\nincrement The optional increment shall be a number\r\n preceded by a \u003cplus-sign\u003e ('+') and suffixed\r\n by one of the following: minutes, hours, days,\r\n weeks, months, or years. (The singular forms\r\n shall also be accepted.) The keyword next\r\n shall be equivalent to an increment number of\r\n +1. For example, the following are equivalent\r\n commands:\r\n at 2pm + 1 week\r\n at 2pm next week\r\n The following grammar describes the precise format of timespec in\r\n the POSIX locale. The general conventions for this style of\r\n grammar are described in Section 1.3, Grammar Conventions. This\r\n formal syntax shall take precedence over the preceding text syntax\r\n description. The longest possible token or delimiter shall be\r\n recognized at a given point. When used in a timespec, white space\r\n shall also delimit tokens.\r\n %token hr24clock_hr_min\r\n %token hr24clock_hour\r\n /*\r\n An hr24clock_hr_min is a one, two, or four-digit number. A one-digit\r\n or two-digit number constitutes an hr24clock_hour. An hr24clock_hour\r\n may be any of the single digits [0,9], or may be double digits, ranging\r\n from [00,23]. If an hr24clock_hr_min is a four-digit number, the\r\n first two digits shall be a valid hr24clock_hour, while the last two\r\n represent the number of minutes, from [00,59].\r\n */\r\n %token wallclock_hr_min\r\n %token wallclock_hour\r\n /*\r\n A wallclock_hr_min is a one, two-digit, or four-digit number.\r\n A one-digit or two-digit number constitutes a wallclock_hour.\r\n A wallclock_hour may be any of the single digits [1,9], or may\r\n be double digits, ranging from [01,12]. If a wallclock_hr_min\r\n is a four-digit number, the first two digits shall be a valid\r\n wallclock_hour, while the last two represent the number of\r\n minutes, from [00,59].\r\n */\r\n %token minute\r\n /*\r\n A minute is a one or two-digit number whose value can be [0,9]\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 5 of 14\n\nor [00,59].\r\n */\r\n %token day_number\r\n /*\r\n A day_number is a number in the range appropriate for the particular\r\n month and year specified by month_name and year_number, respectively.\r\n If no year_number is given, the current year is assumed if the given\r\n date and time are later this year. If no year_number is given and\r\n the date and time have already occurred this year and the month is\r\n not the current month, next year is the assumed year.\r\n */\r\n %token year_number\r\n /*\r\n A year_number is a four-digit number representing the year A.D., in\r\n which the at_job is to be run.\r\n */\r\n %token inc_number\r\n /*\r\n The inc_number is the number of times the succeeding increment\r\n period is to be added to the specified date and time.\r\n */\r\n %token timezone_name\r\n /*\r\n The name of an optional timezone suffix to the time field, in an\r\n implementation-defined format.\r\n */\r\n %token month_name\r\n /*\r\n One of the values from the mon or abmon keywords in the LC_TIME\r\n locale category.\r\n */\r\n %token day_of_week\r\n /*\r\n One of the values from the day or abday keywords in the LC_TIME\r\n locale category.\r\n */\r\n %token am_pm\r\n /*\r\n One of the values from the am_pm keyword in the LC_TIME locale\r\n category.\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 6 of 14\n\n*/\r\n %start timespec\r\n %%\r\n timespec : time\r\n | time date\r\n | time increment\r\n | time date increment\r\n | nowspec\r\n ;\r\n nowspec : \"now\"\r\n | \"now\" increment\r\n ;\r\n time : hr24clock_hr_min\r\n | hr24clock_hr_min timezone_name\r\n | hr24clock_hour \":\" minute\r\n | hr24clock_hour \":\" minute timezone_name\r\n | wallclock_hr_min am_pm\r\n | wallclock_hr_min am_pm timezone_name\r\n | wallclock_hour \":\" minute am_pm\r\n | wallclock_hour \":\" minute am_pm timezone_name\r\n | \"noon\"\r\n | \"midnight\"\r\n ;\r\n date : month_name day_number\r\n | month_name day_number \",\" year_number\r\n | day_of_week\r\n | \"today\"\r\n | \"tomorrow\"\r\n ;\r\n increment : \"+\" inc_number inc_period\r\n | \"next\" inc_period\r\n ;\r\n inc_period : \"minute\" | \"minutes\"\r\n | \"hour\" | \"hours\"\r\n | \"day\" | \"days\"\r\n | \"week\" | \"weeks\"\r\n | \"month\" | \"months\"\r\n | \"year\" | \"years\"\r\n ;\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 7 of 14\n\nSTDIN         top\r\n The standard input shall be a text file consisting of commands\r\n acceptable to the shell command language described in Chapter 2,\r\n Shell Command Language. The standard input shall only be used if\r\n no -f file option is specified.\r\nINPUT FILES         top\r\n See the STDIN section.\r\n The text files at.allow and at.deny, which are located in an\r\n implementation-defined directory, shall contain zero or more user\r\n names, one per line, of users who are, respectively, authorized or\r\n denied access to the at and batch utilities.\r\nENVIRONMENT VARIABLES         top\r\n The following environment variables shall affect the execution of\r\n at:\r\n LANG Provide a default value for the internationalization\r\n variables that are unset or null. (See the Base\r\n Definitions volume of POSIX.1‐2017, Section 8.2,\r\n Internationalization Variables for the precedence of\r\n internationalization variables used to determine the\r\n values of locale categories.)\r\n LC_ALL If set to a non-empty string value, override the values\r\n of all the other internationalization variables.\r\n LC_CTYPE Determine the locale for the interpretation of sequences\r\n of bytes of text data as characters (for example,\r\n single-byte as opposed to multi-byte characters in\r\n arguments and input files).\r\n LC_MESSAGES\r\n Determine the locale that should be used to affect the\r\n format and contents of diagnostic messages written to\r\n standard error and informative messages written to\r\n standard output.\r\n NLSPATH Determine the location of message catalogs for the\r\n processing of LC_MESSAGES.\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 8 of 14\n\nLC_TIME Determine the format and contents for date and time\r\n strings written and accepted by at.\r\n SHELL Determine a name of a command interpreter to be used to\r\n invoke the at-job. If the variable is unset or null, sh\r\n shall be used. If it is set to a value other than a name\r\n for sh, the implementation shall do one of the\r\n following: use that shell; use sh; use the login shell\r\n from the user database; or any of the preceding\r\n accompanied by a warning diagnostic about which was\r\n chosen.\r\n TZ Determine the timezone. The job shall be submitted for\r\n execution at the time specified by timespec or -t time\r\n relative to the timezone specified by the TZ variable.\r\n If timespec specifies a timezone, it shall override TZ.\r\n If timespec does not specify a timezone and TZ is unset\r\n or null, an unspecified default timezone shall be used.\r\nASYNCHRONOUS EVENTS         top\r\n Default.\r\nSTDOUT         top\r\n When standard input is a terminal, prompts of unspecified format\r\n for each line of the user input described in the STDIN section may\r\n be written to standard output.\r\n In the POSIX locale, the following shall be written to the\r\n standard output for each job when jobs are listed in response to\r\n the -l option:\r\n \"%s\\t%s\\n\", at_job_id, \u003cdate\u003e\r\n where date shall be equivalent in format to the output of:\r\n date +\"%a %b %e %T %Y\"\r\n The date and time written shall be adjusted so that they appear in\r\n the timezone of the user (as determined by the TZ variable).\r\nSTDERR         top\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 9 of 14\n\nIn the POSIX locale, the following shall be written to standard\r\n error when a job has been successfully submitted:\r\n \"job %s at %s\\n\", at_job_id, \u003cdate\u003e\r\n where date has the same format as that described in the STDOUT\r\n section. Neither this, nor warning messages concerning the\r\n selection of the command interpreter, shall be considered a\r\n diagnostic that changes the exit status.\r\n Diagnostic messages, if any, shall be written to standard error.\r\nOUTPUT FILES         top\r\n None.\r\nEXTENDED DESCRIPTION         top\r\n None.\r\nEXIT STATUS         top\r\n The following exit values shall be returned:\r\n 0 The at utility successfully submitted, removed, or listed a\r\n job or jobs.\r\n \u003e0 An error occurred.\r\nCONSEQUENCES OF ERRORS         top\r\n The job shall not be scheduled, removed, or listed.\r\n The following sections are informative.\r\nAPPLICATION USAGE         top\r\n The format of the at command line shown here is guaranteed only\r\n for the POSIX locale. Other cultures may be supported with\r\n substantially different interfaces, although implementations are\r\n encouraged to provide comparable levels of functionality.\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 10 of 14\n\nSince the commands run in a separate shell invocation, running in\r\n a separate process group with no controlling terminal, open file\r\n descriptors, traps, and priority inherited from the invoking\r\n environment are lost.\r\n Some implementations do not allow substitution of different shells\r\n using SHELL. System V systems, for example, have used the login\r\n shell value for the user in /etc/passwd. To select reliably\r\n another command interpreter, the user must include it as part of\r\n the script, such as:\r\n $ at 1800\r\n myshell myscript\r\n EOT\r\n job ... at ...\r\n $\r\nEXAMPLES         top\r\n 1. This sequence can be used at a terminal:\r\n at -m 0730 tomorrow\r\n sort \u003c file \u003eoutfile\r\n EOT\r\n 2. This sequence, which demonstrates redirecting standard error\r\n to a pipe, is useful in a command procedure (the sequence of\r\n output redirection specifications is significant):\r\n at now + 1 hour \u003c\u003c!\r\n diff file1 file2 2\u003e\u00261 \u003eoutfile | mailx mygroup\r\n !\r\n 3. To have a job reschedule itself, at can be invoked from within\r\n the at-job. For example, this daily processing script named\r\n my.daily runs every day (although crontab is a more\r\n appropriate vehicle for such work):\r\n # my.daily runs every day\r\n daily processing\r\n at now tomorrow \u003c my.daily\r\n 4. The spacing of the three portions of the POSIX locale timespec\r\n is quite flexible as long as there are no ambiguities.\r\n Examples of various times and operand presentation include:\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 11 of 14\n\nat 0815am Jan 24\r\n at 8 :15amjan24\r\n at now \"+ 1day\"\r\n at 5 pm FRIday\r\n at '17\r\n utc+\r\n 30minutes'\r\nRATIONALE         top\r\n The at utility reads from standard input the commands to be\r\n executed at a later time. It may be useful to redirect standard\r\n output and standard error within the specified commands.\r\n The -t time option was added as a new capability to support an\r\n internationalized way of specifying a time for execution of the\r\n submitted job.\r\n Early proposals added a ``jobname'' concept as a way of giving\r\n submitted jobs names that are meaningful to the user submitting\r\n them. The historical, system-specified at_job_id gives no\r\n indication of what the job is. Upon further reflection, it was\r\n decided that the benefit of this was not worth the change in\r\n historical interface. The at functionality is useful in simple\r\n environments, but in large or complex situations, the\r\n functionality provided by the Batch Services option is more\r\n suitable.\r\n The -q option historically has been an undocumented option, used\r\n mainly by the batch utility.\r\n The System V -m option was added to provide a method for informing\r\n users that an at-job had completed. Otherwise, users are only\r\n informed when output to standard error or standard output are not\r\n redirected.\r\n The behavior of at \u003cnow\u003e was changed in an early proposal from\r\n being unspecified to submitting a job for potentially immediate\r\n execution. Historical BSD at implementations support this.\r\n Historical System V implementations give an error in that case,\r\n but a change to the System V versions should have no backwards-\r\n compatibility ramifications.\r\n On BSD-based systems, a -u user option has allowed those with\r\n appropriate privileges to access the work of other users. Since\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 12 of 14\n\nthis is primarily a system administration feature and is not\r\n universally implemented, it has been omitted. Similarly, a\r\n specification for the output format for a user with appropriate\r\n privileges viewing the queues of other users has been omitted.\r\n The -f file option from System V is used instead of the BSD method\r\n of using the last operand as the pathname. The BSD method is\r\n ambiguous—does:\r\n at 1200 friday\r\n mean the same thing if there is a file named friday in the current\r\n directory?\r\n The at_job_id is composed of a limited character set in historical\r\n practice, and it is mandated here to invalidate systems that might\r\n try using characters that require shell quoting or that could not\r\n be easily parsed by shell scripts.\r\n The at utility varies between System V and BSD systems in the way\r\n timezones are used. On System V systems, the TZ variable affects\r\n the at-job submission times and the times displayed for the user.\r\n On BSD systems, TZ is not taken into account. The BSD behavior is\r\n easily achieved with the current specification. If the user wishes\r\n to have the timezone default to that of the system, they merely\r\n need to issue the at command immediately following an unsetting or\r\n null assignment to TZ. For example:\r\n TZ= at noon ...\r\n gives the desired BSD result.\r\n While the yacc-like grammar specified in the OPERANDS section is\r\n lexically unambiguous with respect to the digit strings, a lexical\r\n analyzer would probably be written to look for and return digit\r\n strings in those cases. The parser could then check whether the\r\n digit string returned is a valid day_number, year_number, and so\r\n on, based on the context.\r\nFUTURE DIRECTIONS         top\r\n None.\r\nSEE ALSO         top\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 13 of 14\n\nbatch(1p), crontab(1p)\r\n The Base Definitions volume of POSIX.1‐2017, Chapter 8,\r\n Environment Variables, Section 12.2, Utility Syntax Guidelines\r\nCOPYRIGHT         top\r\n Portions of this text are reprinted and reproduced in electronic\r\n form from IEEE Std 1003.1-2017, Standard for Information\r\n Technology -- Portable Operating System Interface (POSIX), The\r\n Open Group Base Specifications Issue 7, 2018 Edition, Copyright\r\n (C) 2018 by the Institute of Electrical and Electronics Engineers,\r\n Inc and The Open Group. In the event of any discrepancy between\r\n this version and the original IEEE and The Open Group Standard,\r\n the original IEEE and The Open Group Standard is the referee\r\n document. The original Standard can be obtained online at\r\n http://www.opengroup.org/unix/online.html .\r\n Any typographical or formatting errors that appear in this page\r\n are most likely to have been introduced during the conversion of\r\n the source files to man page format. To report such errors, see\r\n https://www.kernel.org/doc/man-pages/reporting_bugs.html .\r\nIEEE/The Open Group 2017 AT(1P)\r\nPages that refer to this page: batch(1p),  crontab(1p)\r\nSource: https://man7.org/linux/man-pages/man1/at.1p.html\r\nhttps://man7.org/linux/man-pages/man1/at.1p.html\r\nPage 14 of 14",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://man7.org/linux/man-pages/man1/at.1p.html"
	],
	"report_names": [
		"at.1p.html"
	],
	"threat_actors": [
		{
			"id": "1f6ae238-765f-4495-9d54-6a7883d7a319",
			"created_at": "2022-10-25T16:07:24.573456Z",
			"updated_at": "2026-04-10T02:00:05.037738Z",
			"deleted_at": null,
			"main_name": "TA511",
			"aliases": [
				"MAN1",
				"Moskalvzapoe"
			],
			"source_name": "ETDA:TA511",
			"tools": [
				"Agentemis",
				"Chanitor",
				"Cobalt Strike",
				"CobaltStrike",
				"Ficker Stealer",
				"Hancitor",
				"NetSupport",
				"NetSupport Manager",
				"NetSupport Manager RAT",
				"NetSupport RAT",
				"NetSupportManager RAT",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "542cf9d0-9c68-428c-aff8-81b6f59dc985",
			"created_at": "2023-02-15T02:01:49.554105Z",
			"updated_at": "2026-04-10T02:00:03.347115Z",
			"deleted_at": null,
			"main_name": "Moskalvzapoe",
			"aliases": [
				"MAN1",
				"TA511"
			],
			"source_name": "MISPGALAXY:Moskalvzapoe",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775439085,
	"ts_updated_at": 1775826740,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b97eb28ac7e4554d6b0b0aa994db1250ed58c541.pdf",
		"text": "https://archive.orkl.eu/b97eb28ac7e4554d6b0b0aa994db1250ed58c541.txt",
		"img": "https://archive.orkl.eu/b97eb28ac7e4554d6b0b0aa994db1250ed58c541.jpg"
	}
}