T1053.003 Cron

T1053.003 Cron

Sub-technique of: T1053

High-Level Description

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.

An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for Persistence. In ESXi environments, cron jobs must be created directly via the crontab file (e.g., /var/spool/cron/crontabs/root).

Kill Chain Phase

• Execution (TA0002)
• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Linux, macOS, ESXi

What to Check

• Identify if Cron technique is applicable to target environment
• Check Linux systems for indicators of Cron
• Check macOS systems for indicators of Cron
• Check ESXi systems for indicators of Cron
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Cron - Replace crontab with referenced file

This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.

Supported Platforms: linux, macos