Query: rule covering Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being esta
Matching passage: Sigma rule: Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being esta. Logsource: linux / file_event. Rule: title: New Cron File Created id: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05 status: experimental description: 'Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment. ' references: - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/ - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2026-04-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux category: file_event detection: selection_cron_dirs: TargetFilename|startswith: - /etc/cron.d/ - /etc/cron.daily/ - /etc/cron.hourly/ - /etc/cron.monthly/ - /etc/cron.weekly/ - /var/spool/cron/crontabs/ - /var/spool/cron/root selection_cron_special_files: TargetFilename|contains: - /etc/cron.allow - /etc/cron.deny - /etc/crontab filter_optional_legit_cron: TargetFilename: - /etc/cron.daily/apt - /etc/cron.daily/dpkg - /etc/cron.daily/passwd - /etc/crontabs/root condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment. level: low
Near-miss passage: Sigma rule: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h. Logsource: windows / process_creation. Rule: title: Abuse of Service Permissions to Hide Services Via Set-Service id: 514e4c3a-c77d-4cde-a00f-046425e2301e related: - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: derived - id: 953945c5-22fe-4a92-9f8a-a9edc1e522da type: similar status: test description: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7) references: - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \pwsh.exe - OriginalFileName: pwsh.dll selection_sddl: CommandLine|contains|all: - 'Set-Service ' - DCLCWPDTSD selection_cmdlet: CommandLine|contains: - '-SecurityDescriptorSddl ' - '-sd ' condition: all of selection_* falsepositives: - Rare intended use of hidden services level: high