Scheduled Cron Task/Job - MacOs

Status: test
Severity: medium
Log source: category process_creation, product macos
Author: Alejandro Ortuno, oscd.community
Source: github.com/SigmaHQ/sigma

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Known false positives

Legitimate administration activities

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.003` Scheduled Task/Job: Cron
Persistence	`T1053.003` Scheduled Task/Job: Cron
Privilege Escalation	`T1053.003` Scheduled Task/Job: Cron

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Scheduled Cron Task/Job - MacOs
id: 7c3b43d8-d794-47d2-800a-d277715aa460
status: test
description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
author: Alejandro Ortuno, oscd.community
date: 2020-10-06
modified: 2022-11-27
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1053.003
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/crontab'
        CommandLine|contains: '/tmp/'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '/crontab'
    CommandLine|contains: '/tmp/'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/tmp/`	`field:"CommandLine" kind:match value:"/tmp/"`
`Image`	ends_with	`/crontab`	`field:"Image" kind:ends_with value:"/crontab"`