Masquerading as Linux Crond Process via 'cp /bin/sh'

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•21

This rule detects attempts to masquerade as the Linux 'crond' process by copying '/bin/sh' to a file ending with '/crond' and executing it. This technique is often used by adversaries to evade detection by making malicious processes appear as legitimate system services.