T1053.003 — Cron

Tactics: Execution, Persistence, Privilege Escalation · Platforms: Linux, macOS, ESXi

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for…

Sub-technique of Scheduled Task/Job (T1053).

Sigma detection rules (3)

T1053.003 Scheduled Task/Job: Cron

title: "T1053.003 Scheduled Task/Job: Cron"
id: 84c1057f-c66a-4bb5-a5ea-85bb7656ceae
description: 'Cross-Platform Detection of Cron Job Abuse for Persistence and Execution. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CronFilePath, RunUser, ExecutionFrequency.'
references:
  - https://attack.mitre.org/techniques/T1053/003
author: Shahrukh Khan
date: 2026-04-17
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.003

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    name: '/etc/crontab'
    nametype:
      - CREATE
      - NORMAL
  selection_dir:
    name|startswith:
      - '/etc/cron.d/'
      - '/var/spool/cron/crontabs/'
  condition: 1 of selection*

falsepositives:
  - Routine legitimate cron job creation/modification by administrators and software installers (e.g., logrotate, certbot renewal hooks).

level: medium

T1053.003 Scheduled Task/Job: Cron

title: "T1053.003 Scheduled Task/Job: Cron"
id: 9c3f90d7-951a-419e-8749-f401663d4227
description: 'Cross-Platform Detection of Cron Job Abuse for Persistence and Execution. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptPath, CronScheduleSyntax, InteractiveUserContext.'
references:
  - https://attack.mitre.org/techniques/T1053/003
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.003

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/usr/lib/cron/tabs/'
      - '/var/at/tabs/'
  condition: selection

falsepositives:
  - Legitimate administrators or configuration management tools editing crontab entries for scheduled jobs.

level: medium

T1053.003 Scheduled Task/Job: Cron

title: "T1053.003 Scheduled Task/Job: Cron"
id: d6956277-b5e4-4ae4-8229-fc593e546c46
description: 'Cross-Platform Detection of Cron Job Abuse for Persistence and Execution. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CrontabFileMonitored, ShellCommandPayload, JobInterval.'
references:
  - https://attack.mitre.org/techniques/T1053/003
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.003

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: '/var/spool/cron/crontabs/'
  selection_edit:
    CommandLine|contains:
      - 'echo'
      - 'cat >>'

  condition: selection and selection_edit

falsepositives:
  - Administrators manually adding legitimate maintenance cron jobs via the same crontab file path will also match.

level: high

Related sub-techniques

Explore