Linux Process Creation: crontab -l Enumeration

Flags Linux executions of /crontab with the -l option to list a user’s scheduled cron tasks.

FreeReviewedSigma · Low · v3

Product: linux
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-06-02
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1007System Service Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Linux process executions where the binary path ends with '/crontab' and the command line contains ' -l', which is commonly used to list a user's scheduled cron tasks. Attackers may use this to discover persistence or understand what jobs are configured before attempting further manipulation. It relies on process creation telemetry with the executed image path and command-line arguments.

Reporting behind it

Related detections9 linkedT1007 — drag to rearrange

Linux Process Execution of esxcli Network Commands for ESXi Network Discovery

Linux Process Execution of esxcli VM Listing Commands

Linux ESXi esxcli VSAN Information Discovery via esxcli Command

Linux Process Creation: ESXi esxcli system discovery via system namespace

Linux ESXi esxcli Storage Information Discovery via esxcli storage commands

PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging

Windows Process Execution of PCHunter (PCHunter64.exe or PCHunter32.exe)

Windows sc.exe Service Query Execution via Process Creation

Windows reg.exe Registry Query Reconnaissance (Process Creation)

Linux Process Creation: crontab -l Enumeration

Pivot detection · T1007 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-crontab-l-enumeration-403ed92c

title: "Linux Process Creation: crontab -l Enumeration"
id: 01062ca0-9d06-4a1d-8721-07e1395aa403
status: test
description: This rule identifies Linux process executions where the binary path ends with '/crontab' and the command line contains ' -l', which is commonly used to list a user's scheduled cron tasks. Attackers may use this to discover persistence or understand what jobs are configured before attempting further manipulation. It relies on process creation telemetry with the executed image path and command-line arguments.
references:
  - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
  - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
  - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
  - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-06-02
tags:
  - attack.discovery
  - attack.t1007
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /crontab
    CommandLine|contains: " -l"
  condition: selection
falsepositives:
  - Legitimate use of crontab
level: low
license: DRL-1.1
related:
  - id: 403ed92c-b7ec-4edd-9947-5b535ee12d46
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL