huntrule

Linux Process Creation: crontab -r Removes Current User Crontab

Identifies attempts to remove the current user crontab via "crontab -r" on Linux.

FreeUnreviewedSigmamediumv1
title: "Linux Process Creation: crontab -r Removes Current User Crontab"
id: 460be5aa-2a2d-465b-b74d-801ac84cbc13
status: test
description: This rule flags Linux process executions where the crontab utility is invoked with the remove option ("-r"). Removing the current crontab can disrupt scheduled tasks and may be used to erase persistence mechanisms or traces. The detection relies on process creation telemetry capturing the executable path/name and the command-line arguments.
references:
  - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_crontab_removal.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: crontab
    CommandLine|contains: " -r"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c2e234de-03a3-41e1-b39a-1e56dc17ba67
    type: derived

What it detects

This rule flags Linux process executions where the crontab utility is invoked with the remove option ("-r"). Removing the current crontab can disrupt scheduled tasks and may be used to erase persistence mechanisms or traces. The detection relies on process creation telemetry capturing the executable path/name and the command-line arguments.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.