Suspicious Masquerading as Linux Crond Process (via auditd)

title: Suspicious Masquerading as Linux Crond Process (via auditd)
id: c889ba3c-9890-5710-a6f3-2f9374bb333e
status: stable
description: This rule detects masquerading occurs when the name or location of an executable, legitimate or malicious, is manipulated or misused for the sake of evading defenses and observation. Several different variations of this method have been observed.
references:
    - https://attack.mitre.org/techniques/T1036/003/
    - https://github.com/redcanaryco/atomic-red-team/blob/8a82e9b66a5b4f4bc5b91089e9f24e0544f20ad7/atomics/T1036.003/T1036.003.md#atomic-test-2---masquerading-as-linux-crond-process
author: Huntrule Team
date: 2026-07-22
tags:
    - attack.stealth
    - attack.t1036.003
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'execve'
        a0: 'cp'
        a1: '/bin/sh'
        a2|endswith: '/crond'
    condition: selection
falsepositives:
    - Unknown
level: medium