T1053.003sub-technique of T1053 Scheduled Task/Job
Cron
Linux · macOS · ESXi1 piece on this siteT1053.003 on attack.mitre.org
Adversaries may abuse the `cron` utility to perform task scheduling for initial or recurring execution of malicious code. The `cron` utility is a time-based job scheduler for Unix-like operating systems. The ` crontab` file contains the schedule of cron entries to be run and the specified times for execution. Any `crontab` files are stored in operating system-specific file paths.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
Read
Analyses, case studies, guides, references and interview questions.
linux-triage.sh: a read-only first-hour collection script for Linux
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
how MITRE says to see it
Cross-Platform Detection of Cron Job Abuse for Persistence and Execution
- Detects creation or modification of crontab entries by non-root users or from abnormal parent processes, followed by the execution of uncommon binaries at scheduled intervals.
- Detects crontab job additions or modifications via `crontab` utility or direct edits, especially those created by interactive users executing hidden or renamed scripts.
- Detects direct modification of crontab entries in /var/spool/cron/crontabs/root or /etc/rc.local.d/local.sh followed by execution of scripts linked to lateral movement or malware persistence.
what reduces it
- M1018 User Account Management. `cron` permissions are controlled by `/etc/cron.allow and /etc/cron.deny`. If there is a `cron.allow` file, then the user or users that need to use `cron` will need to be listed in the file. `cron.deny` is used to explicitly disallow users from using cron. If neither files exist, then only the super user is allowed to run cron.
- M1047 Audit. Review changes to the `cron` schedule. `cron` execution can be reviewed within the `/var/log` directory. To validate the location of the `cron` log file, check the syslog config at `/etc/rsyslog.conf` or `/etc/syslog.conf`.