Elastic Defend high stable eql

Cron Tab Creation or Modification via Shell Command

Detects the creation or modification of cron tabs by a suspicious or malicious process. Cron is one of the most well known persistence mechanisms for macOS. It is a scheduler that allows a user to create a scheduled execution. Threat actors have abused this tool to persist their malware on macOS systems.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5s
[process where event.type == "start" and (process.name in ("bash", "sh", "zsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and process.args == "-c" and
  not process.command_line : ("*/.claude/shell-snapshots/*", "*/.codex/shell_snapshots/*", "*/.cursor/shell-snapshots/*")]
[file where event.action != "deletion" and 
  file.path like "/private/var/at/tabs/*" and
  process.executable == "/usr/bin/crontab" and not
  file.path == "/private/var/at/tabs/root"]

Field Validations

Loading…

Comments (0)

Loading comments...