Applied Cybernetics Group
T1053.003 Cron
- Technique
T1053.003- Tactics
- Execution, Persistence, Privilege Escalation
- Research, 90 days
- 2
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 6
- Elastic, Splunk
- 22
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1053/003
MITRE description
Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths. An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-31Microsoft Threat Intelligence: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor -
2026-10-19Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
Detection coverage
SigmaHQ community rules
- Azure Kubernetes CronJob (core)
- Modifying Crontab (core)
- New Cron File Created (core)
- Triple Cross eBPF Rootkit Default Persistence (core)
- Scheduled Cron Task/Job - Linux (core)
- Scheduled Cron Task/Job - MacOs (core)
Elastic and Splunk rules
- Modification of Persistence Relevant Files Detected via Defend for Containers (elastic)
- Suspicious Echo or Printf Execution Detected via Defend for Containers (elastic)
- Potential Persistence via File Modification (elastic)
- Suspicious Network Activity to the Internet by Previously Unknown Executable (elastic)
- Suspicious Execution from Foomatic-rip or Cupsd Parent (elastic)
- Pod or Container Creation with Suspicious Command-Line (elastic)
- Cron Job Created or Modified (elastic)
- Executable Bit Set for Potential Persistence Script (elastic)
- Suspicious CronTab Creation or Modification (elastic)
- Potential Persistence via Periodic Tasks (elastic)
- Privilege Escalation via Root Crontab File Modification (elastic)
- Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) (elastic)
- Cisco Isovalent - Cron Job Creation (splunk)
- Linux Add Files In Known Crontab Directories (splunk)
- Linux At Allow Config File Creation (splunk)
- Linux Auditd Edit Cron Table Parameter (splunk)
- Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File (splunk)
- Linux Crontab Enumeration (splunk)
- Linux Edit Cron Table Parameter (splunk)
- Linux Possible Append Cronjob Entry on Existing Cronjob File (splunk)
- Linux Possible Cronjob Modification With Editor (splunk)
- Cisco Secure Firewall - Wget or Curl Download (splunk)