Linux cron: Suspicious crontab modification with REPLACE

Alerts on Linux cron activity indicating crontab changes containing the keyword "REPLACE".

FreeReviewedSigma · Medium · v3

Product: linux
Service: cron
Author: Pawel Mazur (SigmaHQ), DRL 1.1
Published: 2022-04-16
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.003Cron
Persistence
- T1053.003Cron
Priv Esc
- T1053.003Cron
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux cron-related activity containing the keyword "REPLACE", which is indicative of a crontab being modified in a way that may be suspicious. Attackers can use cron persistence by altering scheduled tasks to execute commands at defined intervals. The detection relies on cron service telemetry that includes the matching keyword in the event data.

Reporting behind it

Related detections9 linkedT1053.003 — drag to rearrange

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

Suspicious Linux Crontab Reboot Persistence to Hidden Sys Cache Binary (via process_creation)

Suspicious Cron Persistence Installing a Downloader via Command Line

Suspicious Cron Persistence File Creation in System Cron Directories (via file_event)

Suspicious Cron Persistence via etc cron.d tsar (via file_event)

Suspicious Cron Job Executing Binary From var tmp via Process Creation

Suspicious Cron Job Persistence Creation on Linux (via process_creation)

Suspicious Cron Persistence File Created in System Cron Directories

Linux cron: Suspicious crontab modification with REPLACE

Pivot detection · T1053.003 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-cron-suspicious-crontab-modification-via-replace-af202fd3

title: "Linux cron: Suspicious crontab modification with REPLACE"
id: 1469f283-0646-4471-a2e5-c741e95da42d
status: test
description: This rule identifies Linux cron-related activity containing the keyword "REPLACE", which is indicative of a crontab being modified in a way that may be suspicious. Attackers can use cron persistence by altering scheduled tasks to execute commands at defined intervals. The detection relies on cron service telemetry that includes the matching keyword in the event data.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml
author: Pawel Mazur, Huntrule Team
date: 2022-04-16
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.003
logsource:
  product: linux
  service: cron
detection:
  keywords:
    - REPLACE
  condition: keywords
falsepositives:
  - Legitimate modification of crontab
level: medium
license: DRL-1.1
related:
  - id: af202fd3-7bff-4212-a25a-fb34606cfcbe
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL