Detectionmediumtest

Modifying Crontab

Detects suspicious modification of crontab file.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Pawel MazurCreated Sat Apr 16af202fd3-7bff-4212-a25a-fb34606cfcbelinux

Log Source

Linuxcron

ProductLinux← raw: linux

Servicecron← raw: cron

Detection Logic

detection:
    keywords:
        - 'REPLACE'
    condition: keywords

False Positives

Legitimate modification of crontab

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

af202fd3-7bff-4212-a25a-fb34606cfcbe

Status

test

Level

medium

Type

Detection

Created

Sat Apr 16

Author

Path

rules/linux/builtin/cron/lnx_cron_crontab_file_modification.yml

Raw Tags

attack.privilege-escalationattack.executionattack.persistenceattack.t1053.003