CmdID

CmdID / Techniques / T1053

T1053.003 Scheduled Task/Job: Cron

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. MITRE ATT&CK

2 Sigma rules T1053.003 on attack.mitre.org

Part of

MITRE ATT&CK
T1053Scheduled Task/Job

Sigma rules tagged with it

process creation, the highest levels first
mediumScheduled Cron Task/Job - LinuxAlejandro Ortuno, oscd.community · Linux
mediumScheduled Cron Task/Job - MacOsAlejandro Ortuno, oscd.community · macOS