Linux Cron Directory File Creation via File Events

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.003Cron
Persistence
- T1053.003Cron
Priv Esc
- T1053.003Cron
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies file creations targeting common Linux cron locations and cron-related control files, which can be used to establish scheduled execution as persistence. Such changes are important because attackers may add new cron entries or modify scheduling by writing files in cron directories. It relies on Linux file event telemetry containing TargetFilename values that match cron directories and special cron files, with optional exclusions for known benign entries.

Reporting behind it

Related detections9 linkedT1053.003 — drag to rearrange

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

Suspicious Linux Crontab Reboot Persistence to Hidden Sys Cache Binary (via process_creation)

Suspicious Cron Persistence Installing a Downloader via Command Line

Suspicious Cron Persistence File Creation in System Cron Directories (via file_event)

Suspicious Cron Persistence via etc cron.d tsar (via file_event)

Suspicious Cron Job Executing Binary From var tmp via Process Creation

Suspicious Cron Job Persistence Creation on Linux (via process_creation)

Suspicious Cron Persistence File Created in System Cron Directories

Linux Cron Directory File Creation via File Events

Pivot detection · T1053.003 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-cron-file-creation-in-cron-directories-6c4e2f43

title: Linux Cron Directory File Creation via File Events
id: f3661277-d72c-4898-9f9c-6dc5e3dec158
status: experimental
description: This rule identifies file creations targeting common Linux cron locations and cron-related control files, which can be used to establish scheduled execution as persistence. Such changes are important because attackers may add new cron entries or modify scheduling by writing files in cron directories. It relies on Linux file event telemetry containing TargetFilename values that match cron directories and special cron files, with optional exclusions for known benign entries.
references:
  - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
  - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
  - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
  - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_susp_cron_file_created.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2026-04-28
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.003
logsource:
  product: linux
  category: file_event
detection:
  selection_cron_dirs:
    TargetFilename|startswith:
      - /etc/cron.d/
      - /etc/cron.daily/
      - /etc/cron.hourly/
      - /etc/cron.monthly/
      - /etc/cron.weekly/
      - /var/spool/cron/crontabs/
      - /var/spool/cron/root
  selection_cron_special_files:
    TargetFilename|contains:
      - /etc/cron.allow
      - /etc/cron.deny
      - /etc/crontab
  filter_optional_legit_cron:
    TargetFilename:
      - /etc/cron.daily/apt
      - /etc/cron.daily/dpkg
      - /etc/cron.daily/passwd
      - /etc/crontabs/root
  condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment.
level: low
license: DRL-1.1
related:
  - id: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL