Persistence Via Cron Files

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•1•55

This rule detects the creation or modification of cron files or files within standard cron directories on Linux systems. Adversaries often abuse the cron utility to establish persistence or schedule malicious tasks for execution at specific times or intervals. Monitoring these file events can help identify unauthorized scheduling of tasks.