Detect Cron in IBM QRadar
Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Adversaries use cron in Linux, macOS, and ESXi environments to execute programs at system startup or on a scheduled basis for persistence, privilege escalation, or execution. Real-world malware families including Kinsing, Skidmap, GoldMax, NKAbuse, Rocke, and Anchor have all leveraged cron for persistence. In ESXi environments, cron jobs must be created directly via the crontab file (e.g., /var/spool/cron/crontabs/root).
MITRE ATT&CK
- Technique
- T1053 Scheduled Task/Job
- Sub-technique
- T1053.003 Cron
- Canonical reference
- https://attack.mitre.org/techniques/T1053/003/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
username,
hostname,
"QIDNAME"(qid) AS event_name,
CATEGORYNAME(category) AS category_name,
payload,
CASE
WHEN payload ILIKE '%crontab%-%e%' OR payload ILIKE '%crontab%-%r%' THEN 1
ELSE 0
END +
CASE
WHEN payload ILIKE '%/etc/crontab%' OR payload ILIKE '%/var/spool/cron%'
OR payload ILIKE '%/etc/cron.d%' OR payload ILIKE '%/var/cron/tabs%' THEN 1
ELSE 0
END +
CASE
WHEN payload ILIKE '%wget%' OR payload ILIKE '%curl%'
OR payload ILIKE '%/dev/tcp%' OR payload ILIKE '%base64 -d%'
OR payload ILIKE '%openssl enc%' THEN 1
ELSE 0
END +
CASE
WHEN payload ILIKE '%bash -i%' OR payload ILIKE '%python -c%'
OR payload ILIKE '%perl -e%' OR payload ILIKE '%sh -c%' THEN 1
ELSE 0
END +
CASE
WHEN payload ILIKE '%/tmp/%' OR payload ILIKE '%/dev/shm/%'
OR payload ILIKE '%/var/tmp/%' THEN 1
ELSE 0
END +
CASE
WHEN payload ILIKE '%chmod +x%' OR payload ILIKE '%chmod 777%'
OR payload ILIKE '%chmod 755%' THEN 1
ELSE 0
END +
CASE
WHEN payload ILIKE '%@reboot%' THEN 1
ELSE 0
END AS suspicion_score,
CASE
WHEN (
CASE WHEN payload ILIKE '%crontab%-%e%' OR payload ILIKE '%crontab%-%r%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%/etc/crontab%' OR payload ILIKE '%/var/spool/cron%' OR payload ILIKE '%/etc/cron.d%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%wget%' OR payload ILIKE '%curl%' OR payload ILIKE '%/dev/tcp%' OR payload ILIKE '%base64 -d%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%bash -i%' OR payload ILIKE '%python -c%' OR payload ILIKE '%perl -e%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%/tmp/%' OR payload ILIKE '%/dev/shm/%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%chmod +x%' OR payload ILIKE '%chmod 777%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%@reboot%' THEN 1 ELSE 0 END
) >= 4 THEN 'CRITICAL'
WHEN (
CASE WHEN payload ILIKE '%crontab%-%e%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%/etc/crontab%' OR payload ILIKE '%/var/spool/cron%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%wget%' OR payload ILIKE '%curl%' OR payload ILIKE '%/dev/tcp%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%bash -i%' OR payload ILIKE '%python -c%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%/tmp/%' OR payload ILIKE '%/dev/shm/%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%chmod +x%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%@reboot%' THEN 1 ELSE 0 END
) >= 3 THEN 'HIGH'
WHEN (
CASE WHEN payload ILIKE '%crontab%-%e%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%/etc/crontab%' OR payload ILIKE '%/var/spool/cron%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%wget%' OR payload ILIKE '%curl%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%bash -i%' THEN 1 ELSE 0 END +
CASE WHEN payload ILIKE '%/tmp/%' THEN 1 ELSE 0 END
) >= 2 THEN 'MEDIUM'
ELSE 'LOW'
END AS risk_level
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Universal DSM', 'Syslog')
AND (
payload ILIKE '%crontab%'
OR payload ILIKE '%/etc/crontab%'
OR payload ILIKE '%/var/spool/cron%'
OR payload ILIKE '%/etc/cron.d%'
OR payload ILIKE '%/etc/cron.daily%'
OR payload ILIKE '%/etc/cron.hourly%'
OR payload ILIKE '%/etc/cron.weekly%'
OR payload ILIKE '%/etc/cron.monthly%'
OR payload ILIKE '%/var/cron/tabs%'
)
AND starttime > NOW() - 86400 SECONDS
HAVING suspicion_score > 0
ORDER BY suspicion_score DESC, starttime DESC
LIMIT 500Detects T1053.003 cron abuse in QRadar by querying Linux/syslog event sources for cron-related file paths and commands, then scoring each event across seven suspicion dimensions: crontab edits, cron file writes, download tools, reverse shell commands, temp directory usage, chmod calls, and @reboot persistence. Produces risk levels from LOW to CRITICAL matching the SPL scoring logic.
Data Sources
Required Tables
False Positives & Tuning
- Scheduled maintenance scripts installed by system administrators that write to /etc/cron.d/ during patch cycles
- Monitoring agents (Datadog, New Relic, Splunk UF) that install cron jobs during initial deployment and may reference temp paths
- CI/CD pipelines running on Linux build agents that use crontab to schedule build or cleanup jobs
Other platforms for T1053.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add Persistent Cron Job via crontab Command
Expected signal: Auditd: syscall write/open on /var/spool/cron/crontabs/<username>. Syslog/cron log: CMD (/tmp/argus_test.sh) entries every minute. Process creation event for crontab command. File creation event for /tmp/argus_test.sh.
- Test 2Add @reboot Persistence Entry to Crontab
Expected signal: Auditd: write to /var/spool/cron/crontabs/<username> with @reboot content. Syslog: crontab modification event. Process creation for crontab command. File creation for /tmp/argus_backdoor_test.sh with chmod +x.
- Test 3Direct Write to /etc/cron.d/ for System-Wide Persistence
Expected signal: Auditd: file creation syscall on /etc/cron.d/argus-test-job. File creation event with initiating process bash/sudo. Syslog: within 5 minutes, CRON execution of curl command will appear in /var/log/cron or /var/log/syslog.
- Test 4Cron Job with Base64-Encoded Payload Download
Expected signal: File creation event on /etc/cron.d/argus-encoded-test. Cron execution logs showing base64 and bash commands. If wget succeeds (requires listener), process creation for wget and the payload. Auditd syscall records for file write.
References (13)
- https://attack.mitre.org/techniques/T1053/003/
- https://www.cloudsek.com/blog/analysis-of-files-used-in-esxiargs-ransomware-attack-against-vmware-esxi-servers
- https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/
- https://research.checkpoint.com/2019/speakup-a-new-undetected-backdoor-linux-threat/
- https://blog.aquasec.com/threat-alert-kinsing-malware-container
- https://www.trendmicro.com/en_us/research/19/i/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload.html
- https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html
- https://www.crowdstrike.com/blog/carbon-spider-skeleton-spider-target-esxi-servers-with-novel-ransomware/
- https://www.welivesecurity.com/2022/01/11/signed-sealed-delivered-securing-operational-technology/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd
- https://linux.die.net/man/5/crontab
- https://www.sans.org/white-papers/1693/
Unlock Pro Content
Get the full detection package for T1053.003 including response playbook, investigation guide, and atomic red team tests.