Potential Persistence via Cron Job

Identifies the creation or execution of a cron job. Adversaries may abuse cron jobs to perform task scheduling for initial or recurring execution of malicious code.

Rule type: query
Rule indices:

• auditbeat-*
• logs-endpoint.events.*

Rule Severity: low
Risk Score: 21
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

• https://archive.f-secure.com/weblog/archives/00002576.html
• https://ss64.com/osx/crontab.html

Tags:

• Elastic
• Host
• Linux
• macOS
• Threat Detection
• Persistence

Version: 100
Rule authors:

• Elastic

Rule license: Elastic License v2

event.category:process and event.type:(start or process_started or info) and
  not user.name:root and
  ((process.name:crontab and not process.args:("-l" or "-r" or "-e" or "-help" or "-h")) or
    (process.parent.name:cron and not process.name:"running job" and
       not process.executable:(/Applications/Docker.app/Contents/Resources/bin/docker or
                               /usr/bin/killall or
                               /usr/sbin/sendmail or
                               /usr/bin/env or
                               /usr/bin/timeshift or
                               /bin/rm)))
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Persistence
  • Id: TA0003
  • Reference URL: https://attack.mitre.org/tactics/TA0003/

• Technique:

  • Name: Scheduled Task/Job
  • Id: T1053
  • Reference URL: https://attack.mitre.org/techniques/T1053/

• Sub Technique:

  • Name: Cron
  • Id: T1053.003
  • Reference URL: https://attack.mitre.org/techniques/T1053/003/