AN0805
Analytic 0805
Linux
Detects creation or modification of crontab entries by non-root users or from abnormal parent processes, followed by the execution of uncommon binaries at scheduled intervals.
auditd:SYSCALL
write
auditd:SYSCALL
execve
[CronFilePath]
System-specific crontab paths may vary across distros or deployments.
[RunUser]
Define if only root or specific admin users are allowed to schedule jobs.
[ExecutionFrequency]
Threshold for suspicious repetition (e.g., every minute jobs).
AN0806
Analytic 0806
macOS
Detects crontab job additions or modifications via `crontab` utility or direct edits, especially those created by interactive users executing hidden or renamed scripts.
macos:unifiedlog
process: crontab edits, launch of cron job
fs:fsusage
file access to /usr/lib/cron/tabs/ and cron output files
[ScriptPath]
Match scheduled binary path to trusted directory baseline.
[CronScheduleSyntax]
Flags excessive frequency or wildcard-heavy cron expressions.
[InteractiveUserContext]
Limit cron job writes from interactive shells.
AN0807
Analytic 0807
ESXi
Detects direct modification of crontab entries in /var/spool/cron/crontabs/root or /etc/rc.local.d/local.sh followed by execution of scripts linked to lateral movement or malware persistence.
esxi:hostd
modification of crontab or local.sh entries
esxi:cron
execution of scheduled job
esxi:vmkernel
spawned shell or execution environment activity
[CrontabFileMonitored]
Admins may customize paths in hardened deployments.
[ShellCommandPayload]
Flag shell-based persistence indicators in local.sh or cron payloads.
[JobInterval]
Time interval of task repetition for outlier identification.