title: Cron Job Created Or Modified
id: 49cf347e-7f86-4b11-bbea-542aebd3d60b
status: experimental
description: Detects creation or modification of cron configuration recorded by an auditd watch.
author: WMouton
date: 2026/10/04
tags:
    - attack.persistence
    - attack.execution
    - attack.t1053.003
logsource:
    product: linux
    service: auditd
detection:
    selection_path:
        type: 'PATH'
        name|startswith:
            - '/etc/cron.d/'
            - '/etc/crontab'
            - '/var/spool/cron/'
    selection_change:
        nametype:
            - 'CREATE'
            - 'DELETE'
            - 'NORMAL'
    condition: all of selection_*
falsepositives:
    - Package installs and upgrades that add cron files
    - Configuration management and scheduled maintenance tooling
level: medium

# companion auditd watch rules:
# -w /etc/cron.d/ -p wa -k cron
# -w /etc/crontab -p wa -k cron
# -w /var/spool/cron/ -p wa -k cron