Scheduled Cron Task/Job - Linux

Status: test
Severity: medium
Log source: category process_creation, product linux
Author: Alejandro Ortuno, oscd.community
Source: github.com/SigmaHQ/sigma

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Known false positives

Legitimate administration activities

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.003` Scheduled Task/Job: Cron
Persistence	`T1053.003` Scheduled Task/Job: Cron
Privilege Escalation	`T1053.003` Scheduled Task/Job: Cron

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: Scheduled Cron Task/Job - Linux
id: 6b14bac8-3e3a-4324-8109-42f0546a347f
status: test
description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
author: Alejandro Ortuno, oscd.community
date: 2020-10-06
modified: 2022-11-27
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1053.003
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: 'crontab'
        CommandLine|contains: '/tmp/'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: 'crontab'
    CommandLine|contains: '/tmp/'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/tmp/`	`field:"CommandLine" kind:match value:"/tmp/"`
`Image`	ends_with	`crontab`	`field:"Image" kind:ends_with value:"crontab"`