macOS Cron Task Abuse via crontab Executed from /tmp

Detects macOS cron scheduling activity where crontab is run with /tmp in the command line.

FreeReviewedSigma · Medium · v2

Product: macos
Category: process_creation
Author: Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-06
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053.003Cron
Persistence
- T1053.003Cron
Priv Esc
- T1053.003Cron
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process executions of crontab where the command line includes paths under /tmp, indicating cron job creation from a temporary directory. Attackers often use /tmp staging to drop or prepare scripts and then schedule them for initial or recurring execution. The detection relies on process creation telemetry that provides the executable path and full command line arguments.

Reporting behind it

Related detections9 linkedT1053.003 — drag to rearrange

Malicious Cron Execution of Binary from tmp Directory on Linux (via process_creation)

Suspicious Process Execution from Hidden Outlaw Config Directory

Suspicious Cron Reboot Persistence Pointing to Hidden User Directory on Linux

Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation

Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken

Suspicious Linux Crontab Reboot Persistence to Hidden Sys Cache Binary (via process_creation)

Suspicious Cron Persistence Installing a Downloader via Command Line

Suspicious Cron Persistence File Creation in System Cron Directories (via file_event)

Suspicious Cron Persistence via etc cron.d tsar (via file_event)

macOS Cron Task Abuse via crontab Executed from /tmp

Pivot detection · T1053.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-cron-job-abuse-via-tmp-crontab-entries-7c3b43d8

title: macOS Cron Task Abuse via crontab Executed from /tmp
id: 57b26184-9e01-407d-8c28-d4e6826c63c3
status: test
description: This rule matches process executions of crontab where the command line includes paths under /tmp, indicating cron job creation from a temporary directory. Attackers often use /tmp staging to drop or prepare scripts and then schedule them for initial or recurring execution. The detection relies on process creation telemetry that provides the executable path and full command line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-11-27
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.003
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /crontab
    CommandLine|contains: /tmp/
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 7c3b43d8-d794-47d2-800a-d277715aa460
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL