Linux crontab Removal via "crontab -r" Process Command Line
Identifies attempts to remove the current user crontab via "crontab -r" on Linux.
FreeReviewedSigma · Medium · v3
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-15
- Updated
- 2026-07-31
What it detects
This rule identifies attempts to remove the current cron configuration by executing the crontab utility with the remove flag. Attackers may use this to disrupt scheduled tasks or eliminate persistence mechanisms by clearing existing cron entries. The detection relies on Linux process creation telemetry that includes the executable path ending with "crontab" and a command line containing " -r".
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-process-creation-crontab-r-removes-current-user-crontab-c2e234de
title: Linux crontab Removal via "crontab -r" Process Command Line
id: 460be5aa-2a2d-465b-b74d-801ac84cbc13
status: test
description: This rule identifies attempts to remove the current cron configuration by executing the crontab utility with the remove flag. Attackers may use this to disrupt scheduled tasks or eliminate persistence mechanisms by clearing existing cron entries. The detection relies on Linux process creation telemetry that includes the executable path ending with "crontab" and a command line containing " -r".
references:
- https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_crontab_removal.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-15
tags:
- attack.stealth
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: crontab
CommandLine|contains: " -r"
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: c2e234de-03a3-41e1-b39a-1e56dc17ba67
type: derived