Scheduled Transfer — Scheduled Data Exfiltration via Linux Cron Jobs

// THREAT: Linux Cron Scheduled Exfiltration
// Requires Microsoft Defender for Endpoint on Linux (DeviceProcessEvents populated for Linux devices)
let ExfilTools = dynamic(["curl", "wget", "scp", "rsync", "nc", "ncat", "socat"]);
let ArchiveTools = dynamic(["tar", "zip", "gzip", "7z"]);
// Signal 1: crontab / cron drop-in file modification
let CrontabEdits = DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOS =~ "Linux"
| where FileName =~ "crontab" and ProcessCommandLine has_any ("-e", "-l", "-u")
| extend Signal = "CrontabModified"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;
// Signal 2: cron/crond spawning a network transfer tool
let CronSpawnedExfil = DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOS =~ "Linux"
| where InitiatingProcessFileName in~ ("cron", "crond", "anacron")
| where FileName in~ (ExfilTools)
| extend Signal = "CronSpawnedTransferTool"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, Signal;
// Signal 3: cron-spawned archive-then-transfer chain (staging pattern)
let CronStaging = DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOS =~ "Linux"
| where InitiatingProcessFileName in~ ("cron", "crond", "anacron")
| where FileName in~ (ArchiveTools)
| where ProcessCommandLine has_any ("/home", "/var/www", "/etc/shadow", "/var/lib/mysql", "pg_dump", "/root")
| extend Signal = "CronArchiveStaging"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, Signal;
CrontabEdits
| union CronSpawnedExfil, CronStaging
| sort by Timestamp desc

index=linux sourcetype="linux:audit" type=EXECVE
(
  (exe="*/crontab" AND (a0="-e" OR a0="-l" OR a0="-u"))
  OR (comm IN ("cron", "crond", "anacron") AND exe IN ("*/curl", "*/wget", "*/scp", "*/rsync", "*/nc", "*/ncat", "*/socat"))
  OR (comm IN ("cron", "crond", "anacron") AND exe IN ("*/tar", "*/zip", "*/gzip", "*/7z")
      AND (a0="*home*" OR a0="*var/www*" OR a0="*shadow*" OR a0="*mysql*"))
)
| eval Signal=case(
    match(exe, "crontab"), "CrontabModified",
    match(exe, "curl|wget|scp|rsync|nc|ncat|socat"), "CronSpawnedTransferTool",
    match(exe, "tar|zip|gzip|7z"), "CronArchiveStaging",
    true(), "Other"
  )
| table _time, host, uid, comm, exe, a0, a1, a2, Signal
| sort - _time

process where host.os.family == "linux" and event.type == "start" and (
  (process.name == "crontab" and process.args in ("-e", "-l", "-u")) or
  (process.parent.name in ("cron", "crond", "anacron") and
   process.name in ("curl", "wget", "scp", "rsync", "nc", "ncat", "socat")) or
  (process.parent.name in ("cron", "crond", "anacron") and
   process.name in ("tar", "zip", "gzip", "7z") and
   process.command_line : ("*/home*", "*/var/www*", "*shadow*", "*mysql*", "*/root*"))
)

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  hostname AS Hostname,
  username AS Username,
  "exe" AS Executable,
  "comm" AS ParentComm,
  "a0" AS Arg0,
  CASE
    WHEN LOWER("exe") LIKE '%crontab%' THEN 'CrontabModified'
    WHEN LOWER("comm") IN ('cron','crond','anacron') AND LOWER("exe") LIKE ANY ('%curl%','%wget%','%scp%','%rsync%','%nc%','%ncat%','%socat%') THEN 'CronSpawnedTransferTool'
    WHEN LOWER("comm") IN ('cron','crond','anacron') AND LOWER("exe") LIKE ANY ('%tar%','%zip%','%gzip%','%7z%') THEN 'CronArchiveStaging'
    ELSE 'Other'
  END AS Signal
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) IN ('Linux OS', 'Linux Audit')
  AND QIDNAME(qid) LIKE '%EXECVE%'
  AND (
    LOWER("exe") LIKE '%crontab%'
    OR (LOWER("comm") IN ('cron','crond','anacron'))
  )
  AND starttime > NOW() - 86400000
ORDER BY EventTime DESC

_sourceCategory=linux/auditd type=EXECVE
| parse "exe=\"*\"" as Exe nodrop
| parse "comm=\"*\"" as Comm nodrop
| parse "a0=\"*\"" as Arg0 nodrop
| where (Exe matches "*crontab*")
    or (Comm in ("cron", "crond", "anacron") and Exe matches "*curl*" or Exe matches "*wget*" or Exe matches "*scp*" or Exe matches "*rsync*" or Exe matches "*nc*" or Exe matches "*socat*")
    or (Comm in ("cron", "crond", "anacron") and (Exe matches "*tar*" or Exe matches "*zip*" or Exe matches "*gzip*"))
| eval Signal = if(Exe matches "*crontab*", "CrontabModified",
    if(Comm matches "cron*" and (Exe matches "*curl*" or Exe matches "*scp*" or Exe matches "*rsync*"), "CronSpawnedTransferTool", "CronArchiveStaging"))
| stats count as EventCount, values(Arg0) as Args by _sourceHost, Comm, Exe, Signal
| sort by EventCount desc

rule linux_cron_scheduled_exfil {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Linux cron-based scheduled data exfiltration via crontab modification or cron spawning transfer/archive tools"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1029"
    created = "2026-07-14"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.platform = "LINUX"
    (
      re.regex($e.target.process.file.full_path, `(?i)crontab$`)
      or (
        re.regex($e.principal.process.file.full_path, `(?i)(cron|crond|anacron)$`) and
        re.regex($e.target.process.file.full_path, `(?i)(curl|wget|scp|rsync|nc|ncat|socat)$`)
      )
      or (
        re.regex($e.principal.process.file.full_path, `(?i)(cron|crond|anacron)$`) and
        re.regex($e.target.process.file.full_path, `(?i)(tar|zip|gzip|7z)$`) and
        re.regex($e.target.process.command_line, `(?i)(/home|/var/www|shadow|mysql|/root)`)
      )
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| Platform="Linux"
| (
    FileName=/(?i)crontab$/
    OR (ParentBaseFileName=/(?i)(cron|crond|anacron)$/ AND FileName=/(?i)(curl|wget|scp|rsync|nc|ncat|socat)$/)
    OR (ParentBaseFileName=/(?i)(cron|crond|anacron)$/ AND FileName=/(?i)(tar|zip|gzip|7z)$/ AND CommandLine=/(?i)(\/home|\/var\/www|shadow|mysql|\/root)/)
  )
| Signal := case {
    FileName=/(?i)crontab/ => "CrontabModified";
    FileName=/(?i)curl|wget|scp|rsync|nc|ncat|socat/ => "CronSpawnedTransferTool";
    * => "CronArchiveStaging"
  }
| groupBy([ComputerName, UserName, FileName, ParentBaseFileName, Signal], function=[count(as=EventCount), collect(CommandLine, limit=10)])
| sort(EventCount, order=desc)