Schedule Cron Jobs

Description

Detect scheduled cron jobs; this is a highly generic detection and certainly needs adjustments and profiling in your environment before operationalization. Simultaneously, exploiting the functionality of cron jobs is among one of the oldest TTPs used by adversaries.

Query · falco

((open_write and fd.name startswith /etc/cron) or
 (spawned_process and proc.name = "crontab"))
and not user_known_cron_jobs

Rule dependencies

Depends on

  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_cron_jobs
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Cron jobs were scheduled to run | file=%fd.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Schedule Cron Jobs · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Schedule Cron Jobs
desc: 'Detect scheduled cron jobs; this is a highly generic detection and certainly
  needs adjustments and profiling in your environment before operationalization. Simultaneously,
  exploiting the functionality of cron jobs is among one of the oldest TTPs used by
  adversaries.

  '
condition: "((open_write and fd.name startswith /etc/cron) or\n (spawned_process and\
  \ proc.name = \"crontab\"))\nand not user_known_cron_jobs\n"
output: Cron jobs were scheduled to run | file=%fd.name evt_type=%evt.type user=%user.name
  user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath
  parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- filesystem
- mitre_execution
- T1053.003

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.