• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    macOS Cron Modification and Suspicious Execution

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Shadows VMB@Vemorian_Mort
    •updated 12 days ago•2•0•3

    Detects crontab modifications or suspicious command execution spawned by the cron daemon on macOS devices, indicating potential persistence or scheduled task abuse.

    Microsoft Sentinel (KQL)

    Tags

    T1053.003 - CronTA0002 - ExecutionTA0003 - PersistenceTA0004 - Privilege EscalationT1053.005 - Scheduled TaskScheduled Task CreatedScheduled Task UpdatedProcess CreationCommand ExecutionmacOSkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?