Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File

SPLUNK detection rule by Teoderick Contreras, Splunk · Apache-2.0

The following analytic detects potential tampering with cronjob files on a Linux system. It leverages logs from Linux Auditd, focusing on events of type PATH or CWD. This activity could be significant because adversaries often use it for persistence or privilege escalation. Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification. If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.

name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File
id: fea71cf0-fa10-4ef6-9202-9682b2e0c477
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: |
    The following analytic detects potential tampering with cronjob files on a Linux system.
    It leverages logs from Linux Auditd, focusing on events of type PATH or CWD.
    This activity could be significant because adversaries often use it for persistence or privilege escalation.
    Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification.
    If confirmed malicious, this could allow attackers to execute unauthorized code automatically, leading to system compromises and unauthorized data access, thereby impacting business operations and data integrity.
data_source:
    - Linux Auditd Path
    - Linux Auditd Cwd
search: |
    `linux_auditd` (type=PATH OR type=CWD)
    | rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"

    | stats
      values(type) as types
      values(name) as names
      values(nametype) as nametype
      values(cwd) as cwd_list
      values(_time) as event_times
      by audit_id, host

    | eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
    | eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
    | eval matched_paths = mvfilter(match(candidate_paths, "/etc/cron.*|.*/cron/.*|/etc/anacrontab.*"))
    | eval match_count = mvcount(matched_paths)
    | eval reconstructed_path = mvindex(matched_paths, 0)
    | eval e_time = mvindex(event_times, 0)
    | where match_count > 0
    | rename host as dest

    | stats count min(e_time) as firstTime max(e_time) as lastTime
      values(nametype) as nametype
      by current_working_directory
         reconstructed_path
         match_count
         dest
         audit_id

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`
how_to_implement: |
    To implement this detection, the process begins by ingesting auditd
    data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
    executions and process details on Unix/Linux systems. These logs should be ingested
    and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
    which is essential for correctly parsing and categorizing the data. The next step
    involves normalizing the field names  to match the field names set by the Splunk
    Common Information Model (CIM) to ensure consistency across different data sources
    and enhance the efficiency of data modeling and make sure the type=CWD record type is activate in your auditd configuration.
    This approach enables effective monitoring and detection of linux endpoints where auditd is deployed.
known_false_positives: |
    False positives may arise from legitimate actions by administrators or network operators who may use these commands for automation purposes.
    Therefore, it's recommended to adjust filter macros to eliminate such false positives.
references:
    - https://attack.mitre.org/techniques/T1053/003/
    - https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
    - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
analytic_story:
    - XorDDos
    - Linux Living Off The Land
    - Compromised Linux Host
    - Linux Privilege Escalation
    - Scheduled Tasks
    - Linux Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1053.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/auditd_path_cron/path_cron.log
          source: auditd
          sourcetype: auditd
      test_type: unit

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

875bdacc-97ed-48f2-8bfd-75a01792f03f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion