Hidden Payload Executed via Scheduled Job

Description

This rule detects hidden executables being executed through cron and systemd. Cron and Systemd can be used to schedule jobs (commands or scripts) to run periodically at fixed times, dates, or intervals. Threat actors may abuse these built-in services to execute malicious commands or scripts at specific times or intervals to establish persistence or escalate privileges.

Query · eql

process where event.type == "start" and event.action == "exec" and (
  (process.parent.name in ("cron", "crond") and process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.args == "-c" and process.args like "*/.*" and not process.args like ("*/.*/*", "*/.*;*")) or
  (process.parent.name == "systemd" and process.args like "*/.*" and process.args_count == 1)
) and not (
  process.command_line in (
    "/bin/sh -c /bin/bash /root/rotate.sh rotate /root/.vault-token",
    "/bin/sh -c crontab -l > $HOME/.crontab",
    "/bin/sh -c autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/.dbbackup.sh",
    "/bin/sh -c bash /root/.stafftimerDatabase.sh",
    "/bin/sh -c bash /root/.db-backup.sh",
    "/bin/bash -c chown root /tmp/.flexlm*",
    "/bin/sh -c crontab -l > $HOME/.crontab.bak",
    "/bin/sh -c /bin/...",
    "/bin/sh -c crontab -l > ~keystone/.crontab.$MAILTAG.keystone",
    "/bin/sh -c /usr/local/bin/autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/bin/getssl -a -q -w /root/.getssl-acme.sectigo.com",
    "/bin/sh -c /webmail/tools/alluser.pl > /webmail/modules/ad_sync/etc/.always_keep.list",
    "/bin/sh -c bash /root/.pf-new-vpn-ssl-check.sh",
    "/bin/sh -c /bin/bash $HOME/.backup.sh",
    "/bin/sh -c /bin/mysql_tzinfo_to_sql /usr/share/zoneinfo/| /bin/mysql --defaults-file=/root/.my.cnf mysql",
    "/bin/sh -c /bin/echo -n >/data/EXPORT/.approved",
    "/bin/sh -c source ~/.bashrc",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl", "/bin/sh -c mysqlcheck --defaults-file=/root/.my.cnf -o misp",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl-lets-encrypt"
  ) or
  process.command_line like (
    "*/home/*/.*.*", "*/opt/invgate/insight-agent/*", "*ansible*", "/bin/sh -c /backup/store_Weight_LABEL/.create_site.sh*",
    "/bin/sh -c /backup/mktphotos/.main*.sh", "/bin/bash -c unset*/var/.cagefs'", "/bin/sh -c *autorestic*", "*/opt/export-ecs-ip/ecs-ip.py*", 
    "/bin/sh -c /usr/local/bin/mettle cache -d /var/cache/mettle *", 
    "/bin/sh -c /opt/tm/mettle/root/mettle cache -d /opt/tm/mettle/root/var/cache/mettle*",
    "/bin/sh -c gssh-agent scp -r *:/mnt/*/common/shared/*/skills_repo/skills ~/.agents"
  ) or
  process.args like (
    "/usr/sbin/tmpwatch*", "/usr/sap/*", "sed*", "*/../*", "cd ~/.unison*", "/usr/sbin/logrotate*",
    "/home/raulsiim/.local/share/JetBrains/Toolbox/apps/intellij-idea-community-edition/bin/idea",
    "/usr/bin/flock*", "export VAULT_ADDR=* VAULT_SKIP_VERIFY=true && /usr/local/bin/vault token renew >> ~/.vault-renewal.log 2>&1"
  ) or
  process.executable like (
    "/opt/eset/eei/bin/*", "/tmp/newroot/tmp/.mount_*", "/tmp/.mount_*", "/opt/gotify/gotify-linux-amd64",
    "/home/*/.local/share/JetBrains/Toolbox/apps/goland/bin/goland", "/home/*/.linuxbrew/opt/etcd/bin/etcd",
    "/tmp/newroot/home/*/.local/share/JetBrains/*", "/home/*/.local/share/caa/caa",
    "/home/*/.local/bin/gitsign-credential-cache",
    "/home/*/.local/share/JetBrains/Toolbox/apps/intellij-idea-ultimate/bin/idea",
    "/home/*/.local/share/JetBrains/*", "/home/*/.local/opt/activitywatch/*",
    "/home/*/.local/bin/claude-oauth-proxy", "/root/.local/openaev-agent-session/openaev-agent",
    "/nix/store/*/bin/.blueman-tray-wrapped", "/var/lib/containers/storage/overlay/nix/store/*/bin/.blueman-tray-wrapped",
    "/home/*/.config/discord/*/Discord"
  ) or
  process.name in ("riptide-agent", "zellij", "gitsign-credential-cache", "jetbrains-toolbox", "goland") or
  process.working_directory == "/var/lib/rabbitmq" or
  (process.working_directory == "/home/oracle" and process.command_line like "/bin/sh -c sh /u01/oradata/*")
)
Raw source Hidden Payload Executed via Scheduled Job · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
This rule detects hidden executables being executed through cron and systemd. Cron and Systemd can be used to schedule
jobs (commands or scripts) to run periodically at fixed times, dates, or intervals. Threat actors may abuse these
built-in services to execute malicious commands or scripts at specific times or intervals to establish persistence or
escalate privileges.
"""
id = "e8b2afe5-37a9-468c-a6fb-f178d46cb698"
license = "Elastic License v2"
name = "Hidden Payload Executed via Scheduled Job"
os_list = ["linux"]
reference = [
    "https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/",
    "https://www.elastic.co/security-labs/primer-on-persistence-mechanisms",
]
version = "1.0.27"

query = '''
process where event.type == "start" and event.action == "exec" and (
  (process.parent.name in ("cron", "crond") and process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.args == "-c" and process.args like "*/.*" and not process.args like ("*/.*/*", "*/.*;*")) or
  (process.parent.name == "systemd" and process.args like "*/.*" and process.args_count == 1)
) and not (
  process.command_line in (
    "/bin/sh -c /bin/bash /root/rotate.sh rotate /root/.vault-token",
    "/bin/sh -c crontab -l > $HOME/.crontab",
    "/bin/sh -c autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/.dbbackup.sh",
    "/bin/sh -c bash /root/.stafftimerDatabase.sh",
    "/bin/sh -c bash /root/.db-backup.sh",
    "/bin/bash -c chown root /tmp/.flexlm*",
    "/bin/sh -c crontab -l > $HOME/.crontab.bak",
    "/bin/sh -c /bin/...",
    "/bin/sh -c crontab -l > ~keystone/.crontab.$MAILTAG.keystone",
    "/bin/sh -c /usr/local/bin/autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/bin/getssl -a -q -w /root/.getssl-acme.sectigo.com",
    "/bin/sh -c /webmail/tools/alluser.pl > /webmail/modules/ad_sync/etc/.always_keep.list",
    "/bin/sh -c bash /root/.pf-new-vpn-ssl-check.sh",
    "/bin/sh -c /bin/bash $HOME/.backup.sh",
    "/bin/sh -c /bin/mysql_tzinfo_to_sql /usr/share/zoneinfo/| /bin/mysql --defaults-file=/root/.my.cnf mysql",
    "/bin/sh -c /bin/echo -n >/data/EXPORT/.approved",
    "/bin/sh -c source ~/.bashrc",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl", "/bin/sh -c mysqlcheck --defaults-file=/root/.my.cnf -o misp",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl-lets-encrypt"
  ) or
  process.command_line like (
    "*/home/*/.*.*", "*/opt/invgate/insight-agent/*", "*ansible*", "/bin/sh -c /backup/store_Weight_LABEL/.create_site.sh*",
    "/bin/sh -c /backup/mktphotos/.main*.sh", "/bin/bash -c unset*/var/.cagefs'", "/bin/sh -c *autorestic*", "*/opt/export-ecs-ip/ecs-ip.py*", 
    "/bin/sh -c /usr/local/bin/mettle cache -d /var/cache/mettle *", 
    "/bin/sh -c /opt/tm/mettle/root/mettle cache -d /opt/tm/mettle/root/var/cache/mettle*",
    "/bin/sh -c gssh-agent scp -r *:/mnt/*/common/shared/*/skills_repo/skills ~/.agents"
  ) or
  process.args like (
    "/usr/sbin/tmpwatch*", "/usr/sap/*", "sed*", "*/../*", "cd ~/.unison*", "/usr/sbin/logrotate*",
    "/home/raulsiim/.local/share/JetBrains/Toolbox/apps/intellij-idea-community-edition/bin/idea",
    "/usr/bin/flock*", "export VAULT_ADDR=* VAULT_SKIP_VERIFY=true && /usr/local/bin/vault token renew >> ~/.vault-renewal.log 2>&1"
  ) or
  process.executable like (
    "/opt/eset/eei/bin/*", "/tmp/newroot/tmp/.mount_*", "/tmp/.mount_*", "/opt/gotify/gotify-linux-amd64",
    "/home/*/.local/share/JetBrains/Toolbox/apps/goland/bin/goland", "/home/*/.linuxbrew/opt/etcd/bin/etcd",
    "/tmp/newroot/home/*/.local/share/JetBrains/*", "/home/*/.local/share/caa/caa",
    "/home/*/.local/bin/gitsign-credential-cache",
    "/home/*/.local/share/JetBrains/Toolbox/apps/intellij-idea-ultimate/bin/idea",
    "/home/*/.local/share/JetBrains/*", "/home/*/.local/opt/activitywatch/*",
    "/home/*/.local/bin/claude-oauth-proxy", "/root/.local/openaev-agent-session/openaev-agent",
    "/nix/store/*/bin/.blueman-tray-wrapped", "/var/lib/containers/storage/overlay/nix/store/*/bin/.blueman-tray-wrapped",
    "/home/*/.config/discord/*/Discord"
  ) or
  process.name in ("riptide-agent", "zellij", "gitsign-credential-cache", "jetbrains-toolbox", "goland") or
  process.working_directory == "/var/lib/rabbitmq" or
  (process.working_directory == "/home/oracle" and process.command_line like "/bin/sh -c sh /u01/oradata/*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"


[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.002"
name = "Systemd Service"
reference = "https://attack.mitre.org/techniques/T1543/002/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"


[[threat.technique]]
id = "T1543"
name = "Create or Modify System Process"
reference = "https://attack.mitre.org/techniques/T1543/"
[[threat.technique.subtechnique]]
id = "T1543.002"
name = "Systemd Service"
reference = "https://attack.mitre.org/techniques/T1543/002/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"

[internal]
min_endpoint_version = "7.15.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.