Suspicious Cron Job or Trojanized Crontab Execution

Danny Y@zendannyy

•updated Mar 8, 2026•2•0•43

Detects suspicious cron job executions or the execution of a potentially trojanized 'crontab' binary. Adversaries, as seen with malware like Perfctl, may replace or modify the 'crontab' utility to hide malicious scheduled tasks from administrators. This detection looks for common patterns of malicious cron jobs.