Cron
Cron [T1053.003]
Last updated
Cron [T1053.003]
Last updated
Name: Cron
ID: T1053.003
Tactics: , ,
Technique:
Cron (T1053.003) is a sub-technique within the Scheduled Task/Job (T1053) category of the MITRE ATT&CK framework. This sub-technique specifically involves adversaries leveraging the Cron utility, a time-based job scheduler native to Unix-like operating systems, to execute commands or scripts automatically at specified intervals. Attackers often exploit Cron to maintain persistence, escalate privileges, or execute malicious payloads covertly within compromised environments.
Cron is a Linux/Unix-based scheduling utility that allows users and administrators to automate tasks by scheduling scripts or commands to execute at predefined times and intervals. Cron jobs are defined in a structured text file called a "crontab," typically located in directories such as /etc/crontab, /etc/cron.d/, /etc/cron.hourly/, /etc/cron.daily/, /etc/cron.weekly/, /etc/cron.monthly/, or user-specific cron files accessed via the crontab -e command.
Cron's syntax consists of five fields specifying the execution timing (minute, hour, day of month, month, day of week), followed by the command or script to execute. For example:
This line executes script.sh every five minutes.
Attackers exploit Cron by:
Adding malicious cron jobs to persistently execute malware or scripts at regular intervals.
Modifying existing legitimate cron jobs to include malicious payloads or commands.
Utilizing Cron to escalate privileges by placing malicious scripts in directories where they execute with elevated privileges (such as /etc/cron.daily/).
Scheduling tasks to reconnect to command-and-control (C2) servers periodically, ensuring persistent communication channels.
Leveraging cron jobs to clean up evidence or logs periodically, complicating forensic investigations.
Cron jobs can execute with varying privileges depending on the user account under which they are scheduled. Adversaries often exploit cron jobs executed by privileged users (such as root) to gain or maintain escalated system access.
Adversaries typically use Cron (T1053.003) in various attack scenarios and stages, including:
Persistence Stage:
Ensuring continuous execution of malicious scripts or payloads even after system reboots or user logouts.
Maintaining long-term access to compromised systems without relying on interactive sessions.
Privilege Escalation Stage:
Exploiting cron jobs running with higher privileges (e.g., root cron jobs) to execute malicious scripts with elevated permissions.
Modifying cron jobs or scripts located in privileged directories (/etc/cron.*) to escalate privileges on compromised hosts.
Execution and Command-and-Control (C2) Stage:
Scheduling periodic execution of scripts that establish or maintain communication with remote attacker infrastructure.
Automating reconnaissance tasks, data exfiltration, or lateral movement activities within compromised networks.
Defense Evasion Stage:
Automating cleanup tasks to remove traces of intrusion, delete logs, or eliminate evidence periodically.
Scheduling tasks at unusual intervals to evade detection by security monitoring tools.
Detection methods for Cron-based attacks typically involve monitoring system configurations, logs, and scheduled tasks for suspicious or unauthorized changes. Common detection approaches include:
File Integrity Monitoring (FIM):
Monitor cron directories and files (/etc/cron.*, /var/spool/cron/*) for unauthorized modifications or additions.
Track changes in crontabs of privileged accounts (root, administrative users).
Audit Logging and Monitoring:
Enable and monitor audit logs (auditd) for modifications to cron configuration files and directories.
Monitor system logs (/var/log/syslog, /var/log/cron, /var/log/messages) for unusual cron job executions, failures, or errors.
Behavioral Analysis and Anomaly Detection:
Identify cron jobs executing at unusual intervals or times.
Detect cron jobs running from suspicious or non-standard locations (such as /tmp, /dev/shm, or user home directories).
Endpoint Detection and Response (EDR) Tools:
Utilize EDR solutions to detect and alert on suspicious cron-related activities, command executions, or script invocations.
Monitor processes spawned by cron jobs for suspicious behaviors, malicious payloads, or network connections.
Specific Indicators of Compromise (IoCs) include:
Unrecognized cron entries executing scripts or binaries from suspicious directories.
Cron jobs executing base64-encoded commands or obfuscated scripts.
Cron entries containing network commands (curl, wget, nc) connecting to unknown or suspicious IP addresses or domains.
Cron entries executing scripts with names mimicking legitimate system utilities or processes.
Early detection of malicious cron-based activities is essential due to the significant risks and impacts associated with this technique, including:
Persistent Access:
Adversaries can maintain long-term, stealthy access to compromised systems, making remediation difficult without timely detection.
Privilege Escalation:
Cron jobs executed under high-privileged accounts (such as root) can enable attackers to escalate privileges and gain full control over compromised systems.
Data Exfiltration and Command-and-Control (C2):
Scheduled tasks can automate periodic data exfiltration or maintain persistent communication channels with attacker-controlled infrastructure.
Defense Evasion and Cleanup:
Cron jobs can automate periodic deletion of logs or forensic evidence, complicating incident response and forensic investigations.
Resource Abuse and Performance Degradation:
Malicious cron tasks can consume significant system resources, degrade performance, or disrupt normal operations.
Prompt detection and response to malicious cron activities can significantly reduce the attackers' dwell time, minimize potential damage, and facilitate rapid containment and remediation efforts.
Real-world examples of Cron (T1053.003) abuse include:
Rocke Group Malware Campaign:
Attackers leveraged cron jobs to persistently execute malicious cryptocurrency mining scripts. Cron entries periodically downloaded and executed updated payloads from remote attacker-controlled servers, ensuring persistent resource exploitation and monetization.
Linux Coin Miners (XMRig, Kinsing):
Malicious cron entries installed by attackers regularly executed scripts to download, update, and execute cryptocurrency mining software (XMRig, Kinsing). These cron jobs ensured continuous mining operations, persistent C2 communications, and self-update mechanisms.
TeamTNT Malware Campaign:
TeamTNT utilized cron jobs to establish persistence and periodically execute scripts that scanned for vulnerable Docker instances and AWS credentials. Cron-based scripts facilitated lateral movement, data exfiltration, and resource abuse within cloud and container environments.
HiddenWasp Malware:
HiddenWasp malware used cron jobs to execute persistent backdoor scripts on compromised Linux systems. Cron jobs periodically re-established connections to attacker-controlled infrastructure, enabling persistent remote access and control.
CronRAT Malware:
CronRAT, a sophisticated Linux malware, exploited cron jobs scheduled on non-existent dates (e.g., February 31) to evade detection. The malware's cron entries appeared benign at first glance but executed malicious payloads covertly, bypassing traditional detection methods.
In all these examples, attackers leveraged Cron to ensure persistence, evade detection, escalate privileges, and automate malicious activities, demonstrating the critical importance of proactive monitoring and detection mechanisms for this sub-technique.