Suspicious Scheduled Cron Task/Job - Linux (via process_creation)

title: Suspicious Scheduled Cron Task/Job - Linux (via process_creation)
id: eba5c1ca-7873-5eab-bfb9-c9ffd495db7c
status: stable
description: This rule detects misuse of the cron utility to perform task scheduling for initial or recurring execution of hostile code. Detection will focus on crontab jobs uploaded from the tmp folder.
references:
    - https://attack.mitre.org/techniques/T1053/003/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
author: Huntrule Team
date: 2026-04-07
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1053.003
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: 'crontab'
        CommandLine|contains: '/tmp/'
    condition: selection
falsepositives:
    - Unknown
level: medium