Sigma rule: New Cron File Created

Rule

Title

New Cron File Created

Status

experimental

Level

low

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC

Date

2021-10-15

Modified

2026-04-28

File

rules/linux/file_event/file_event_lnx_susp_cron_file_created.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker.
Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.
This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.
Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.
Additionally, it is recommended to review the contents of the newly created cron files to assess their intent.
Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.

Log source

product

linux

category

file_event

Detection

selection_cron_dirs:
    TargetFilename|startswith:
        - '/etc/cron.d/'
        - '/etc/cron.daily/'
        - '/etc/cron.hourly/'
        - '/etc/cron.monthly/'
        - '/etc/cron.weekly/'
        - '/var/spool/cron/crontabs/'
        - '/var/spool/cron/root'
selection_cron_special_files:
    TargetFilename|contains:
        - '/etc/cron.allow'
        - '/etc/cron.deny'
        - '/etc/crontab'
filter_optional_legit_cron:
    # Note: FPs on docker images: golang, postgres, python, redis, ruby
    TargetFilename:
        - '/etc/cron.daily/apt'
        - '/etc/cron.daily/dpkg'
        - '/etc/cron.daily/passwd'
        - '/etc/crontabs/root'
condition: 1 of selection_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment.

Tags

• attack.privilege-escalation
• attack.execution
• attack.persistence
• attack.t1053.003

MITRE ATT&CK ids this rule names

• T1053.003

References

• https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
• https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
• https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
• https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/file_event/file_event_lnx_susp_cron_file_created.yml