From where I'm at
a) if it's being logged as having been run as user theo then we know theo is in /etc/at.allow Maybe anticipate the mystery process' next run and temporarily remove/disallow user theo Later, see error log for user theo The fully-spelled mystery command may show up.
Also check root's error log (or errlog of anyone else in /etc/at.allow) in case the mystery command is invoked by spoofing .. $ sudo su theo -c "/explicitpath/script.sh"
And, further on Theodore's mention of the -m option for at
b1) I am a fan of alias, so .. add to your ~/bashrc alias at='/usr/bin/at -m'
(for this Debian+bash example: to be accurate in spelling out the explicit invoke path, here, I did a $ which at and I was surprised to learn Ubuntu/Mint does not include it [at] in default install) Hmpf.
b2) $ sudo mv /usr/bin/at /usr/bin/_at Then write a clever script named /usr/bin/at ( <-- no .SH this time) That can jot out a few notes about how & when it got called, then invoke the intended process, calling the re-named binary _at
c) Optional reading - - at-tangent at ack-ack attack - -
Early OCR would substitute a default character for any it could not recognise, into its text output. The chosen char was commonly @ Until you tuned scan resolution, etc (or until better OCR came along) your output would contain a lot of @
My pal Walter Gibbons is blind and in ancient days, we futzed with his kit to run OCR output thru his spiffy DECTalk TextToSpeech jobby, which would faithfully voice each @ simply as "AT" In the tuning, we sure laughed a lot (and swore) @ all the @ @ @, and we still n@ter at each other "AT AT, AT-AT-AT" for lev@y.
Meanwhile .. my theory is th@ one of the writers of "Mars @tacks!" must have also run flaky OCR output through TextToSpeech and those creepy aliens' eery language was h@ched !
I pointed out to Walter that one of the sc@ological folk-names for the "@"-sign was dog[poop], and I pointed out further that we can 'train' the TextToSpeech to pronounce @ any way we wish. Walter cog@ated a bit, and declined the enhancement. Just as well, for soon, email was everywhere, and his system might have voiced: " EmailName DOG[POOP] email.com "