cron job added
Detects cron-based persistence — a job written into a system cron location (/etc/cron.*, /etc/crontab, /var/spool/cron).
What it detects
Detects cron-based persistence — a job written into a system cron location (/etc/cron.*, /etc/crontab, /var/spool/cron). Cron is a durable, reboot-surviving foothold frequently used to re-launch implants.
MITRE ATT&CK mapping
- T1053.003Scheduled Task/Job: Cron· Execution
False positives and triage
Package installs and legitimate admin automation also write cron entries. Review the job command, the writing user, and whether the payload path is world-writable or in /tmp.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/linux/cron_persistence.yaml, licensed under the Apache License 2.0.
id: linux.persistence.cron_job_added
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [linux]
mitre_techniques: [T1053.003]
description: |
Detects cron-based persistence — a job written into a system cron location
(/etc/cron.*, /etc/crontab, /var/spool/cron). Cron is a durable, reboot-surviving
foothold frequently used to re-launch implants.
match:
file_path_contains_any:
- "/etc/cron"
- "/etc/crontab"
- "/var/spool/cron"
false_positive_guidance: |
Package installs and legitimate admin automation also write cron entries. Review the job
command, the writing user, and whether the payload path is world-writable or in /tmp.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.