huntrule

macOS Cron Job Abuse via /tmp Crontab Entries

Detects macOS cron scheduling activity where crontab is run with /tmp in the command line.

FreeUnreviewedSigmamediumv1
title: macOS Cron Job Abuse via /tmp Crontab Entries
id: 57b26184-9e01-407d-8c28-d4e6826c63c3
status: test
description: This rule flags macOS process executions where the /crontab binary is invoked with a command line containing /tmp. It indicates potential attacker staging of cron job contents from a temporary location for one-time or recurring execution. The detection relies on process creation telemetry that includes the executed image path and the full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-11-27
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.003
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /crontab
    CommandLine|contains: /tmp/
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 7c3b43d8-d794-47d2-800a-d277715aa460
    type: derived

What it detects

This rule flags macOS process executions where the /crontab binary is invoked with a command line containing /tmp. It indicates potential attacker staging of cron job contents from a temporary location for one-time or recurring execution. The detection relies on process creation telemetry that includes the executed image path and the full command line.

Known false positives

  • Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.