{"id":"T1053.003","name":"Cron","url":"https://attack.mitre.org/techniques/T1053/003","tactics":["execution","persistence","privilege-escalation"],"platforms":["Linux","macOS","ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0290","stix_id":"x-mitre-detection-strategy--6bab4067-9bfc-4e7f-b7fc-e578acd81e6a","name":"Cross-Platform Detection of Cron Job Abuse for Persistence and Execution","url":"https://attack.mitre.org/detectionstrategies/DET0290","analytics":[{"id":"AN0805","stix_id":"x-mitre-analytic--0fbbc547-37a7-4d00-a8a4-5fbcf3d27a1e","name":"Analytic 0805","description":"Detects creation or modification of crontab entries by non-root users or from abnormal parent processes, followed by the execution of uncommon binaries at scheduled intervals.","url":"https://attack.mitre.org/detectionstrategies/DET0290#AN0805","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"CronFilePath","description":"System-specific crontab paths may vary across distros or deployments."},{"field":"RunUser","description":"Define if only root or specific admin users are allowed to schedule jobs."},{"field":"ExecutionFrequency","description":"Threshold for suspicious repetition (e.g., every minute jobs)."}],"live":true,"detection_strategies":["DET0290"],"techniques":["T1053.003"]},{"id":"AN0806","stix_id":"x-mitre-analytic--8a764f0e-4bcd-413d-bbf0-1a10cb98b598","name":"Analytic 0806","description":"Detects crontab job additions or modifications via `crontab` utility or direct edits, especially those created by interactive users executing hidden or renamed scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0290#AN0806","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process: crontab edits, launch of cron job","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"file access to /usr/lib/cron/tabs/ and cron output files","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"ScriptPath","description":"Match scheduled binary path to trusted directory baseline."},{"field":"CronScheduleSyntax","description":"Flags excessive frequency or wildcard-heavy cron expressions."},{"field":"InteractiveUserContext","description":"Limit cron job writes from interactive shells."}],"live":true,"detection_strategies":["DET0290"],"techniques":["T1053.003"]},{"id":"AN0807","stix_id":"x-mitre-analytic--3ea6b02e-47e0-4815-9190-4e95eb51e779","name":"Analytic 0807","description":"Detects direct modification of crontab entries in /var/spool/cron/crontabs/root or /etc/rc.local.d/local.sh followed by execution of scripts linked to lateral movement or malware persistence.","url":"https://attack.mitre.org/detectionstrategies/DET0290#AN0807","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"modification of crontab or local.sh entries","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"esxi-hostd"},{"name":"esxi:cron","channel":"execution of scheduled job","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"esxi-cron"},{"name":"esxi:vmkernel","channel":"spawned shell or execution environment activity","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-vmkernel"}],"mutable_elements":[{"field":"CrontabFileMonitored","description":"Admins may customize paths in hardened deployments."},{"field":"ShellCommandPayload","description":"Flag shell-based persistence indicators in local.sh or cron payloads."},{"field":"JobInterval","description":"Time interval of task repetition for outlier identification."}],"live":true,"detection_strategies":["DET0290"],"techniques":["T1053.003"]}],"live":true,"version":"1.0","techniques":["T1053.003"]}],"sigma_rules":[{"id":"1a2ea919-d11d-4d1e-8535-06cda13be20f","title":"Triple Cross eBPF Rootkit Default Persistence","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-05","modified":"2022-12-31","description":"Detects the creation of \"ebpfbackdoor\" files in both \"cron.d\" and \"sudoers.d\" directories. Which both are related to the TripleCross persistence method","references":["https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.003"],"path":"rules/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml","techniques":["T1053.003"],"cves":[]},{"id":"1c71e254-6655-42c1-b2d6-5e4718d7fc0a","title":"Azure Kubernetes CronJob","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-11-22","modified":"2022-12-18","description":"Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.\nKubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.\nAn Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.\n","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/","https://kubernetes.io/docs/concepts/workloads/controllers/job/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.persistence","attack.t1053.003","attack.privilege-escalation","attack.execution"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml","techniques":["T1053.003"],"cves":[]},{"id":"6b14bac8-3e3a-4324-8109-42f0546a347f","title":"Scheduled Cron Task/Job - Linux","author":"Alejandro Ortuno, oscd.community","status":"test","level":"medium","date":"2020-10-06","modified":"2022-11-27","description":"Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.t1053.003"],"path":"rules/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml","techniques":["T1053.003"],"cves":[]},{"id":"6c4e2f43-d94d-4ead-b64d-97e53fa2bd05","title":"New Cron File Created","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"experimental","level":"low","date":"2021-10-15","modified":"2026-04-28","description":"Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker.\nNote that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.\nThis detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.\nFocus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.\nAdditionally, it is recommended to review the contents of the newly created cron files to assess their intent.\nFurthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.\n","references":["https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml","https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/","https://www.elastic.co/security-labs/primer-on-persistence-mechanisms","https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4"],"logsource":{"product":"linux","category":"file_event"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.003"],"path":"rules/linux/file_event/file_event_lnx_susp_cron_file_created.yml","techniques":["T1053.003"],"cves":[]},{"id":"7c3b43d8-d794-47d2-800a-d277715aa460","title":"Scheduled Cron Task/Job - MacOs","author":"Alejandro Ortuno, oscd.community","status":"test","level":"medium","date":"2020-10-06","modified":"2022-11-27","description":"Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.t1053.003"],"path":"rules/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml","techniques":["T1053.003"],"cves":[]},{"id":"af202fd3-7bff-4212-a25a-fb34606cfcbe","title":"Modifying Crontab","author":"Pawel Mazur","status":"test","level":"medium","date":"2022-04-16","modified":null,"description":"Detects suspicious modification of crontab file.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md"],"logsource":{"product":"linux","service":"cron"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.003"],"path":"rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml","techniques":["T1053.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}