Linux Cron File Creation in Cron Directories

Flags new Linux cron-related files created under standard cron directories, excluding a few known benign paths.

FreeUnreviewedSigmalowv1

linux-cron-file-creation-in-cron-directories-6c4e2f43

title: Linux Cron File Creation in Cron Directories
id: f3661277-d72c-4898-9f9c-6dc5e3dec158
status: experimental
description: This rule identifies file creation events targeting common Linux cron locations, including /etc/cron.* directories and /var/spool/cron/crontabs/ (including root). Attackers often use cron for persistence by dropping or modifying scheduled job files. The rule relies on Linux file event telemetry containing TargetFilename and matches specific cron-related paths and filenames, while excluding a small set of known legitimate files that commonly appear in certain environments. Investigate created cron files in context (creator, timing, and job content) because not all cron writes are malicious.
references:
  - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
  - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
  - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
  - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_cron_file_created.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2026-04-28
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.003
logsource:
  product: linux
  category: file_event
detection:
  selection_cron_dirs:
    TargetFilename|startswith:
      - /etc/cron.d/
      - /etc/cron.daily/
      - /etc/cron.hourly/
      - /etc/cron.monthly/
      - /etc/cron.weekly/
      - /var/spool/cron/crontabs/
      - /var/spool/cron/root
  selection_cron_special_files:
    TargetFilename|contains:
      - /etc/cron.allow
      - /etc/cron.deny
      - /etc/crontab
  filter_optional_legit_cron:
    TargetFilename:
      - /etc/cron.daily/apt
      - /etc/cron.daily/dpkg
      - /etc/cron.daily/passwd
      - /etc/crontabs/root
  condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment.
level: low
license: DRL-1.1
related:
  - id: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05
    type: derived

What it detects

This rule identifies file creation events targeting common Linux cron locations, including /etc/cron.* directories and /var/spool/cron/crontabs/ (including root). Attackers often use cron for persistence by dropping or modifying scheduled job files. The rule relies on Linux file event telemetry containing TargetFilename and matches specific cron-related paths and filenames, while excluding a small set of known legitimate files that commonly appear in certain environments. Investigate created cron files in context (creator, timing, and job content) because not all cron writes are malicious.

Known false positives

Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.