Crontab File Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•1•65

Detects suspicious modification of the crontab file, which can be used by adversaries for persistence, privilege escalation, or execution of malicious code on Unix-like systems. The rule specifically looks for the 'REPLACE' keyword in cron logs, indicating a crontab entry has been changed.