BIOC Informational

Persistence using cron jobs

Cron jobs are tasks to be executed sometime in the future, and could be used to persist malware.

Module:
Platform Analytics
Agent event type:
File
Category:
Persistence
Status:
Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Scheduled Task/Job: Cron (T1053.003)
Indicator:

File action type = create , write AND file path = /var/spool/cron/crontabs/* , /etc/crontab* , /etc/cron.hourly/* , /etc/cron.daily/* , /etc/cron.weekly/* , /etc/cron.monthly/* , /etc/cron.d* , /var/spool/cron/atjobs* , /var/spool/at* , /etc/at.allow* , /etc/at.deny* , /etc/cron.allow* , /etc/cron.deny* , /etc/anacrontab* Process initiator cmd != *atd -f* AND *puppet* AND cgo cmd != *atd -f* AND *puppet* AND initiated by != *zabbix_server* AND initiated by != puppet AND yum AND cgo name != *zabbix_server* AND cgo name != puppet AND yum

Preventable: yes