Anchor can install itself as a cron job.^[3]

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.^[4]

APT5 has made modifications to the crontab file including in/var/cron/tabs/.^[5]

Exaramel for Linux uses crontab for persistence if it does not have root privileges.^[6][7]

TheGoldMax Linux variant has used a crontab entry with a@reboot line to gain persistence.^[8]

Gomir will configure a crontab for process execution to start the backdoor on reboot if it is not initially running under group 0 privileges.^[9]

Janicab used a cron job for persistence on Mac devices.^[10]

Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.^[11]

NETWIRE can use crontabs to establish persistence.^[12]

NKAbuse uses a Cron job to establish persistence when infecting Linux hosts.^[13]

DuringOperation MidnightEclipse, threat actors configured cron jobs to retrieve payloads from actor-controlled infrastructure.^[14][15]

Penquin can use Cron to create periodic and pre-scheduled background jobs.^[16]

Rocke installed a cron job that downloaded and executed files from the C2.^[17][18][19]

Skidmap has installed itself via crontab.^[20]

SpeakUp uses cron tasks to ensure persistence.^[21]

Xbash can create a cronjob for persistence if it determines it is on a Linux system.^[22]

Review changes to thecron schedule.cron execution can be reviewed within the/var/log directory. To validate the location of thecron log file, check the syslog config at/etc/rsyslog.conf or/etc/syslog.conf.

cron permissions are controlled by/etc/cron.allow and /etc/cron.deny. If there is acron.allow file, then the user or users that need to usecron will need to be listed in the file.cron.deny is used to explicitly disallow users from using cron. If neither files exist, then only the super user is allowed to run cron.

Detects creation or modification of crontab entries by non-root users or from abnormal parent processes, followed by the execution of uncommon binaries at scheduled intervals.

Detects crontab job additions or modifications viacrontab utility or direct edits, especially those created by interactive users executing hidden or renamed scripts.

Detects direct modification of crontab entries in /var/spool/cron/crontabs/root or /etc/rc.local.d/local.sh followed by execution of scripts linked to lateral movement or malware persistence.