# T1053.003 - Cron
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1053/003)
<blockquote>Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems.  The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence. <code>cron</code> can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Cron - Replace crontab with referenced file](#atomic-test-1---cron---replace-crontab-with-referenced-file)

- [Atomic Test #2 - Cron - Add script to all cron subfolders](#atomic-test-2---cron---add-script-to-all-cron-subfolders)

- [Atomic Test #3 - Cron - Add script to /var/spool/cron/crontabs/ folder](#atomic-test-3---cron---add-script-to-varspoolcroncrontabs-folder)


<br/>

## Atomic Test #1 - Cron - Replace crontab with referenced file
This test replaces the current user's crontab file with the contents of the referenced file. This technique was used by numerous IoT automated exploitation attacks.

**Supported Platforms:** macOS, Linux


**auto_generated_guid:** 435057fb-74b1-410e-9403-d81baf194f75





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command | Command to execute | String | /tmp/evil.sh|
| tmp_cron | Temporary reference file to hold evil cron schedule | Path | /tmp/persistevil|


#### Attack Commands: Run with `bash`! 


```bash
crontab -l > /tmp/notevil
echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}
```

#### Cleanup Commands:
```bash
crontab /tmp/notevil
```





<br/>
<br/>

## Atomic Test #2 - Cron - Add script to all cron subfolders
This test adds a script to /etc/cron.hourly, /etc/cron.daily, /etc/cron.monthly and /etc/cron.weekly folders configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.

**Supported Platforms:** macOS, Linux


**auto_generated_guid:** b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command | Command to execute | String | echo 'Hello from Atomic Red Team' > /tmp/atomic.log|
| cron_script_name | Name of file to store in cron folder | String | persistevil|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
echo "#{command}" > /etc/cron.daily/#{cron_script_name}
echo "#{command}" > /etc/cron.hourly/#{cron_script_name}
echo "#{command}" > /etc/cron.monthly/#{cron_script_name}
echo "#{command}" > /etc/cron.weekly/#{cron_script_name}
```

#### Cleanup Commands:
```bash
rm /etc/cron.daily/#{cron_script_name}
rm /etc/cron.hourly/#{cron_script_name}
rm /etc/cron.monthly/#{cron_script_name}
rm /etc/cron.weekly/#{cron_script_name}
```





<br/>
<br/>

## Atomic Test #3 - Cron - Add script to /var/spool/cron/crontabs/ folder
This test adds a script to a /var/spool/cron/crontabs folder configured to execute on a schedule. This technique was used by the threat actor Rocke during the exploitation of Linux web servers.

**Supported Platforms:** Linux


**auto_generated_guid:** 2d943c18-e74a-44bf-936f-25ade6cccab4





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| command | Command to execute | String | echo 'Hello from Atomic Red Team' > /tmp/atomic.log|
| cron_script_name | Name of file to store in /var/spool/cron/crontabs folder | String | persistevil|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
echo "#{command}" >> /var/spool/cron/crontabs/#{cron_script_name}
```

#### Cleanup Commands:
```bash
rm /var/spool/cron/crontabs/#{cron_script_name}
```





<br/>
