Skip to content
This repository was archived by the owner on Feb 10, 2021. It is now read-only.

Local Job Scheduling

iosifache edited this page Jan 12, 2020 · 2 revisions

MITRE ATT&CK ID: T1168 Permissions Required: user or root

Release Date: december 2019 Tests: passed

Attack Vector

On Linux systems, a method is widely supported for creating pre-scheduled and periodic background jobs: cron.

Detection

Legitimate scheduled jobs may be created during the installation of new software or through administration functions. Jobs scheduled with cron can be monitored from their respective utilities to list out detailed information about the jobs.

Module Configuration

  • checked scheduling files that will be modified if having permission
  • the command format that will be placed in the checked scheduling files

Clone this wiki locally