Linux Masquerading via crond Path Using cp Launching /bin/sh

Alerts on Linux execve where cp runs through /bin/sh and the argument ends with /crond, indicating potential masquerading.

FreeReviewedSigma · Medium · v3

Product: linux
Service: auditd
Author: Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-21
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.003Rename Legitimate Utilities
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process executions where cp is invoked to run /bin/sh and the command argument ends with /crond. Such behavior can indicate masquerading, where attackers abuse executable naming or placement to evade monitoring and make activity resemble a legitimate cron-related process. It relies on Linux auditd telemetry capturing execve fields (process type and argv content).

Reporting behind it

Related detections9 linkedT1036.003 — drag to rearrange

Renamed Autohotkey Binary

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Renamed Execution of a Renamed Windows System Utility (via process_creation)

Suspicious Renamed Pythonw Interpreter Execution via XWorm Loader (via process_creation)

Suspicious PowerShell Masquerading as Windows Terminal via process_creation

Windows Schtasks Execution with Renamed schtasks.exe Binary

Windows RMM Tool MeshAgent Execution with Renamed MeshServiceName

macOS Process Creation: MeshAgent renamed execution via --meshServiceName

Linux Masquerading via crond Path Using cp Launching /bin/sh

Pivot detection · T1036.003 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-masquerading-cp-via-bin-sh-ending-with-crond-9d4548fa

title: Linux Masquerading via crond Path Using cp Launching /bin/sh
id: caed63d0-6bcf-4fba-9f6d-e36d211f5534
status: test
description: This rule matches process executions where cp is invoked to run /bin/sh and the command argument ends with /crond. Such behavior can indicate masquerading, where attackers abuse executable naming or placement to evade monitoring and make activity resemble a legitimate cron-related process. It relies on Linux auditd telemetry capturing execve fields (process type and argv content).
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1036.003/T1036.003.md#atomic-test-2---masquerading-as-linux-crond-process
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_masquerading_crond.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-08-22
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: execve
    a0: cp
    a1: /bin/sh
    a2|endswith: /crond
  condition: selection
level: medium
license: DRL-1.1
related:
  - id: 9d4548fa-bba0-4e88-bd66-5d5bf516cda0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL