Crontab file or cron drop-in directory written on Linux

1title: Crontab file or cron drop-in directory written on Linux2id: d1211ae7-280f-4182-9b93-c55ba2d668ba3status: experimental4description: |5  Matches the file-modification leg of AN0805: an auditd PATH record naming one6  of the stores cron reads its schedule from — the per-user spool under7  /var/spool/cron/, the system-wide /etc/crontab and /etc/anacrontab, and the8  drop-in directories /etc/cron.d/ and the hourly, daily, weekly and monthly9  run-parts folders. The path list is MITRE's `CronFilePath` knob, populated10  here with the Debian and RHEL layouts; a distribution that keeps its spool11  elsewhere needs its own entry. ESXi is one of the technique's platforms and12  its crontab lives at the same /var/spool/cron/crontabs/root path, but ESXi13  runs no auditd, so this logsource does not reach it and the ESXi arm of the14  technique is uncovered. Matching is on `contains` and `endswith` rather than15  an absolute path because `crontab -e` writes a temporary file and renames it16  into the spool — the rename target is what shows up, not the editor's scratch17  file. That does not rescue the relative case: auditd records `name=` exactly18  as it was handed to the syscall, so `cd /etc/cron.d && echo '* * * * * root19  /tmp/x' > job` logs `name="job"`, with the directory on a separate CWD record20  that Sigma cannot join, and no path selection here can match it. Such a write21  is caught only by the fourth selection, which matches the audit `key` the22  watches below install and which rides on the SYSCALL record whatever form the23  path took — so it works only if those watches were loaded with that exact24  `-k cron` key.25  Two parts of the analytic cannot be expressed here. auditd emits PATH and26  SYSCALL as separate records for one event, and the writing process's `exe`,27  `uid` and `auid` live only on the SYSCALL side, so MITRE's `RunUser` knob28  ("only root may schedule jobs") cannot be applied inside this selection; and29  the analytic's second half — an uncommon binary later executing on the30  schedule, with MITRE's `ExecutionFrequency` knob thresholding how often — is a31  cross-event correlation Sigma has no way to state. The macOS arm AN0806 is32  not attempted, because its unifiedlog source has no standardised Sigma field33  names and inventing them would produce a rule that renders everywhere and34  matches nothing. Prerequisite: no distribution audits these paths by default,35  so this rule returns zero rows until watches such as36  `-w /var/spool/cron -p wa -k cron`, `-w /etc/crontab -p wa -k cron` and37  `-w /etc/cron.d -p wa -k cron` are loaded — and zero rows reads as quiet when38  it actually means blind. The `wa` permission also decides the noise floor:39  with it, only writes and attribute changes are recorded, whereas a watch that40  includes `r` makes every scan by the cron daemon itself match.41  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0290, not hand-written and not tested by its author. Any lab result is on this rule's own page.42references:43  - https://attack.mitre.org/techniques/T1053/00344  - https://attack.mitre.org/detectionstrategies/DET029045author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)46date: 2026-08-1647tags:48  - attack.execution49  - attack.persistence50  - attack.privilege-escalation51  - attack.t1053.00352logsource:53  product: linux54  service: auditd55detection:56  selection_spool:57    type: 'PATH'58    name|contains:59      - '/var/spool/cron/'60  selection_dropin_dirs:61    type: 'PATH'62    name|contains:63      - '/etc/cron.d/'64      - '/etc/cron.hourly/'65      - '/etc/cron.daily/'66      - '/etc/cron.weekly/'67      - '/etc/cron.monthly/'68  selection_system_tables:69    type: 'PATH'70    name|endswith:71      - '/etc/crontab'72      - '/etc/anacrontab'73  selection_watch_key:74    key: 'cron'75  condition: 1 of selection*76falsepositives:77  - "Package installation, upgrade and removal. Distribution packages routinely ship their own schedule into /etc/cron.d or /etc/cron.daily — logrotate, mlocate/plocate, man-db, sysstat, certbot and unattended-upgrades among them — so every apt or dnf transaction on every host writes several matching PATH records. On a patched estate this is the highest-volume match by a wide margin and is why this rule is low rather than medium."78  - "Configuration management convergence. The Ansible cron module, Puppet cron resources, Chef and Salt all rewrite /var/spool/cron/crontabs/<user> or drop a fragment into /etc/cron.d on every run, which on a half-hourly schedule means a match per managed host per run whether or not the content changed."79  - "Agent and appliance installers. Backup, monitoring, vulnerability-scanning and antivirus packages install their own cron entry at setup and rewrite it at each version upgrade, under root, from a legitimate package manager."80  - "A user or administrator running `crontab -e` to add, edit or remove a normal job, or reinstalling a saved table with `crontab mytab`. This is the everyday supported way to schedule work and is separated from the technique only by who did it and what the entry runs."81  - "Host provisioning: cloud-init runcmd blocks, container image builds and golden-image bake scripts writing crontabs while the machine is being created, which produces a burst of matches on every new host."82level: low