T1053.003_cron

T1053.003 Cron

Sub-technique of: T1053

High-Level Description

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.

An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for Persistence. In ESXi environments, cron jobs must be created directly via the crontab file (e.g., /var/spool/cron/crontabs/root).

Kill Chain Phase

• Execution (TA0002)
• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Linux, macOS, ESXi

What to Check

• Identify if Cron technique is applicable to target environment
• Check Linux systems for indicators of Cron
• Check macOS systems for indicators of Cron
• Check ESXi systems for indicators of Cron
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Cron - Replace crontab with referenced file

This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.

Supported Platforms: linux, macos

crontab -l > /tmp/notevil
echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}

Atomic Test 2: Cron - Add script to all cron subfolders

This test adds a script to /etc/cron.hourly, /etc/cron.daily, /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.

Supported Platforms: macos, linux Elevation Required: Yes

echo "#{command}" > /etc/cron.daily/#{cron_script_name}
echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
echo "#{command}" > /etc/cron.weekly/#{cron_script_name}

Atomic Test 3: Cron - Add script to /etc/cron.d folder

This test adds a script to /etc/cron.d folder configured to execute on a schedule.

Supported Platforms: linux Elevation Required: Yes

echo "#{command}" > /etc/cron.d/#{cron_script_name}

Atomic Test 4: Cron - Add script to /var/spool/cron/crontabs/ folder

This test adds a script to a /var/spool/cron/crontabs folder configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.

Supported Platforms: linux Elevation Required: Yes

echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Cron by examining the target platforms (Linux, macOS, ESXi).

2. Assess Existing Defenses: Review whether mitigations for T1053.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1047 Audit

Review changes to the cron schedule. cron execution can be reviewed within the /var/log directory. To validate the location of the cron log file, check the syslog config at /etc/rsyslog.conf or /etc/syslog.conf.

M1018 User Account Management

cron permissions are controlled by /etc/cron.allow and /etc/cron.deny. If there is a cron.allow file, then the user or users that need to use cron will need to be listed in the file. cron.deny is used to explicitly disallow users from using cron. If neither files exist, then only the super user is allowed to run cron.

Detection

Cross-Platform Detection of Cron Job Abuse for Persistence and Execution

Risk Assessment

CWE Categories

References

• CloudSEK ESXiArgs 2023
• 20 macOS Common Tools and Techniques
• Atomic Red Team - T1053.003
• MITRE ATT&CK - T1053.003