SigmaHQ/rules/linux/lnx_schedule_task_job_cron.yml

title: Scheduled Cron Task/Job
id: 6b14bac8-3e3a-4324-8109-42f0546a347f
status: experimental
description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
author: Alejandro Ortuno, oscd.community
date: 2020/10/06
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ProcessName|endswith:
      - '/crontab'
    CommandLine|contains:
      - '/tmp/'
  condition: selection
falsepositives:
    - Legitimate administration activities
level: medium
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege_escalation
    - attack.t1053.003