Cron job created or modified

Threat behaviour covered

Cron runs commands on a schedule and is a common way to keep a foothold, because a new entry survives reboots. The rule flags changes to cron directories and files that auditd records.

Detection logic

title: Cron Job Created Or Modified
id: 49cf347e-7f86-4b11-bbea-542aebd3d60b
status: experimental
description: Detects creation or modification of cron configuration recorded by an auditd watch.
author: WMouton
date: 2026/10/04
tags:
    - attack.persistence
    - attack.execution
    - attack.t1053.003
logsource:
    product: linux
    service: auditd
detection:
    selection_path:
        type: 'PATH'
        name|startswith:
            - '/etc/cron.d/'
            - '/etc/crontab'
            - '/var/spool/cron/'
    selection_change:
        nametype:
            - 'CREATE'
            - 'DELETE'
            - 'NORMAL'
    condition: all of selection_*
falsepositives:
    - Package installs and upgrades that add cron files
    - Configuration management and scheduled maintenance tooling
level: medium

# companion auditd watch rules:
# -w /etc/cron.d/ -p wa -k cron
# -w /etc/crontab -p wa -k cron
# -w /var/spool/cron/ -p wa -k cron

Data sources

• Linux auditd with watches on the cron paths above.

False positives and tuning

• Package manager activity: join the event with the parent process and exclude changes made by the package manager itself.
• Review who changed the file (auid) and the new content rather than alerting on every change.

Limitations

• Does not cover systemd timers, at jobs or shell profile persistence. Treat it as one persistence rule among several.