Linux Masquerading via crond Path Using cp Launching /bin/sh

title: Linux Masquerading via crond Path Using cp Launching /bin/sh
id: caed63d0-6bcf-4fba-9f6d-e36d211f5534
status: test
description: This rule matches process executions where cp is invoked to run /bin/sh and the command argument ends with /crond. Such behavior can indicate masquerading, where attackers abuse executable naming or placement to evade monitoring and make activity resemble a legitimate cron-related process. It relies on Linux auditd telemetry capturing execve fields (process type and argv content).
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1036.003/T1036.003.md#atomic-test-2---masquerading-as-linux-crond-process
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_masquerading_crond.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-08-22
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: execve
    a0: cp
    a1: /bin/sh
    a2|endswith: /crond
  condition: selection
level: medium
license: DRL-1.1
related:
  - id: 9d4548fa-bba0-4e88-bd66-5d5bf516cda0
    type: derived