BIOC
Informational
✕
Persistence using cron jobs
Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job: Cron (T1053.003)
Indicator:
File action type = create , write AND file path = /var/spool/cron/crontabs/* , /etc/crontab* , /etc/cron.hourly/* , /etc/cron.daily/* , /etc/cron.weekly/* , /etc/cron.monthly/* , /etc/cron.d* , /var/spool/cron/atjobs* , /var/spool/at* , /etc/at.allow* , /etc/at.deny* , /etc/cron.allow* , /etc/cron.deny* , /etc/anacrontab* Process initiator cmd != *atd -f* AND *puppet* AND cgo cmd != *atd -f* AND *puppet* AND initiated by != *zabbix_server* AND initiated by != puppet AND yum AND cgo name != *zabbix_server* AND cgo name != puppet AND yum
Preventable: yes