Scheduled Cron Task/Job from /tmp - Linux

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects the creation or modification of scheduled cron jobs where the command line argument contains '/tmp/'. This behavior is often indicative of an adversary attempting to establish persistence or execute malicious code from a temporary directory using the cron utility.