Linux Cron Abuse via crontab Executed with /tmp/ File Paths

Identifies crontab usage on Linux where /tmp/ is present in the command line, suggesting cron job staging for persistence or execution.

FreeReviewedSigma · Medium · v2

Product: linux
Category: process_creation
Author: Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.003Cron
Persistence
- T1053.003Cron
Priv Esc
- T1053.003Cron
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process executions of crontab where the command line includes a /tmp/ path, suggesting cron job content may be staged from temporary storage. Attackers often use cron for initial execution or recurring persistence by scheduling malicious commands through crontab. The detection relies on process creation telemetry capturing the executed image name and full command line.

Reporting behind it

Related detections9 linkedT1053.003 — drag to rearrange

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

Suspicious Linux Crontab Reboot Persistence to Hidden Sys Cache Binary (via process_creation)

Suspicious Cron Persistence Installing a Downloader via Command Line

Suspicious Cron Persistence File Creation in System Cron Directories (via file_event)

Suspicious Cron Persistence via etc cron.d tsar (via file_event)

Suspicious Cron Job Executing Binary From var tmp via Process Creation

Suspicious Cron Job Persistence Creation on Linux (via process_creation)

Suspicious Cron Persistence File Created in System Cron Directories

Linux Cron Abuse via crontab Executed with /tmp/ File Paths

Pivot detection · T1053.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-cron-job-uploads-from-tmp-via-crontab-process-creation-6b14bac8

title: Linux Cron Abuse via crontab Executed with /tmp/ File Paths
id: 4357788b-54a3-49dd-ae19-31a3646aaa81
status: test
description: This rule flags Linux process executions of crontab where the command line includes a /tmp/ path, suggesting cron job content may be staged from temporary storage. Attackers often use cron for initial execution or recurring persistence by scheduling malicious commands through crontab. The detection relies on process creation telemetry capturing the executed image name and full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-11-27
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: crontab
    CommandLine|contains: /tmp/
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 6b14bac8-3e3a-4324-8109-42f0546a347f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL