t1053-003-cron

name	T1053.003_cron
description	Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1053.003","execution","persistence","privilege-escalation","linux","macos","esxi","sub-technique"]
technique_id	T1053.003
tactic	execution
all_tactics	["execution","persistence","privilege-escalation"]
platforms	["Linux","macOS","ESXi"]
mitre_url	https://attack.mitre.org/techniques/T1053/003
tech_stack	["linux","macos","esxi"]
cwe_ids	["CWE-94"]
chains_with	["T1053","T1053.002","T1053.005","T1053.006","T1053.007"]
prerequisites	["T1053"]
severity_boost	{"T1053":"Chain with T1053 for deeper attack path","T1053.002":"Chain with T1053.002 for deeper attack path","T1053.005":"Chain with T1053.005 for deeper attack path"}

T1053.003 Cron

Sub-technique of: T1053

High-Level Description

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.

An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for Persistence. In ESXi environments, cron jobs must be created directly via the crontab file (e.g., /var/spool/cron/crontabs/root).

Kill Chain Phase

• Execution (TA0002)
• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Linux, macOS, ESXi

What to Check

• Identify if Cron technique is applicable to target environment
• Check Linux systems for indicators of Cron
• Check macOS systems for indicators of Cron
• Check ESXi systems for indicators of Cron
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Cron - Replace crontab with referenced file

This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.

Supported Platforms: linux, macos

crontab -l > /tmp/notevil
echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}

Atomic Test 2: Cron - Add script to all cron subfolders