0142-crontab-add: Crontab Scheduled Task Added¶

Rule ID¶

• 0142-crontab-add

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• A crontab scheduled task has been added.

Scan Frequency¶

• disable

Rationale¶

• Whether a crontab scheduled task has been added on the host. If an unknown crontab scheduled task is added on the host, it may cause information security leakage. Therefore, it must be within the audit scope.

Risk Items¶

• Hacking penetration

• Data leakage

• Network security

• Cryptojacking risk

• Botnet risk

Audit Method¶

• Verify whether a crontab scheduled task has been added on the host. You can run the following command to verify:

cat /etc/passwd | cut -f 1 -d : |xargs -I {} crontab -l -u {}

Remediation¶

• If a crontab scheduled task has been added on the host, be sure to carefully review the user's crontab scheduled tasks. If any suspicious crontab scheduled task exists, delete it.

crontab -e

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None