Linux Cron Job Uploads from /tmp via crontab Process Creation

Identifies crontab usage on Linux where /tmp/ is present in the command line, suggesting cron job staging for persistence or execution.

FreeUnreviewedSigmamediumv1

linux-cron-job-uploads-from-tmp-via-crontab-process-creation-6b14bac8

title: Linux Cron Job Uploads from /tmp via crontab Process Creation
id: 4357788b-54a3-49dd-ae19-31a3646aaa81
status: test
description: This rule flags Linux process executions where the crontab utility is run with a command line containing /tmp/, indicating cron job content sourced from the temporary directory. Attackers commonly use cron for initial execution or persistence by scheduling recurring or delayed execution of malicious code. The detection relies on process creation telemetry capturing the crontab process image name and its command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-11-27
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.003
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: crontab
    CommandLine|contains: /tmp/
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 6b14bac8-3e3a-4324-8109-42f0546a347f
    type: derived

What it detects

This rule flags Linux process executions where the crontab utility is run with a command line containing /tmp/, indicating cron job content sourced from the temporary directory. Attackers commonly use cron for initial execution or persistence by scheduling recurring or delayed execution of malicious code. The detection relies on process creation telemetry capturing the crontab process image name and its command-line arguments.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.