Linux Cron: Suspicious Crontab Modification via REPLACE

Alerts on Linux cron activity indicating crontab changes containing the keyword "REPLACE".

FreeUnreviewedSigmamediumv1

linux-cron-suspicious-crontab-modification-via-replace-af202fd3

title: "Linux Cron: Suspicious Crontab Modification via REPLACE"
id: 1469f283-0646-4471-a2e5-c741e95da42d
status: test
description: This rule flags events associated with modifying a user's crontab that contain the keyword "REPLACE". Attackers may use cron changes to gain persistent command execution without relying on interactive sessions. Detection relies on Linux cron-related telemetry that includes the matching keyword in the recorded activity.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml
author: Pawel Mazur, Huntrule Team
date: 2022-04-16
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.003
logsource:
  product: linux
  service: cron
detection:
  keywords:
    - REPLACE
  condition: keywords
falsepositives:
  - Legitimate modification of crontab
level: medium
license: DRL-1.1
related:
  - id: af202fd3-7bff-4212-a25a-fb34606cfcbe
    type: derived

What it detects

This rule flags events associated with modifying a user's crontab that contain the keyword "REPLACE". Attackers may use cron changes to gain persistent command execution without relying on interactive sessions. Detection relies on Linux cron-related telemetry that includes the matching keyword in the recorded activity.

Known false positives

Legitimate modification of crontab

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.