Elastic Defend high stable eql

Potential Persistence via Direct Crontab Modification

Detects the modification of the crontab file. Attackers can modify the crontab file to execute commands at specific times or intervals to maintain persistence on the system. Modifying the crontab directly is uncommon, and abused by attackers to automate persistence.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and process.name == "crontab" and process.args == "-" and
process.parent.executable like (
  "./*", "/dev/shm/*", "/tmp/*", "/var/tmp/*", "/boot/*", "/etc/cron*", "/etc/init.d/*", "/etc/update-motd.d/*",
  "/srv/*", "/var/log/*", "/var/www/*", "/home/*/.*"
) and not (
  process.parent.executable in (
    "/var/www/html/admin/modules/iotserver/bin/check_license.php",
    "/tmp/newroot/opt/puppetlabs/puppet/bin/puppet",
    "/tmp/package/install.sh",
    "/tmp/newroot/usr/sbin/veeamworker",
    "/tmp/newroot/usr/sbin/veeamservice"
  ) or
  process.parent.command_line in (
    "/bin/bash +x ./ninja-deb-uninstall.sh", "./update-cronjobs.sh", "/bin/bash ./leip.sh", "/bin/bash ./2leip.sh"
  ) or
  process.parent.name == "bundle" or
  process.working_directory == "/opt/microsoft/mdatp/conf" or
  process.parent.args like "/var/lib/dpkg/*" or
  process.env_vars == "LD_LIBRARY_PATH=/opt/bmc/bladelogic/RSCD/lib" or
  process.parent.executable like (
    "/home/*/.local/share/uv/python/cpython-*-linux-x86_64-gnu/bin/python*",
    "/home/*/.rbenv/versions/*/bin/ruby"
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...