Remove Scheduled Cron Task/Job

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects the usage of the 'crontab' utility with the '-r' flag to remove the current user's crontab. This activity can be indicative of an adversary attempting to remove scheduled tasks for defense evasion or to eliminate competition, such as in the case of cryptocurrency miners.