0143-crontab-del Crontab Task Deleted¶

Rule ID¶

• 0143-crontab-del

Category¶

• system

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• The crontab scheduled task has been deleted.

Scan Frequency¶

• disable

Rationale¶

• Whether the host has deleted crontab scheduled tasks. If the host deletes unknown crontab scheduled tasks, it may cause information security leakage. Therefore, it needs to be within the audit scope.

Risk Items¶

• Hacker Infiltration

• Data Leakage

• Network Security

• Mining Risk

• Botnet Risk

Audit Method¶

• Verify whether the host has deleted crontab scheduled tasks. You can run the following command to verify:

cat /etc/passwd | cut -f 1 -d : |xargs -I {} crontab -l -u {}

Remediation¶

• If the host has deleted crontab scheduled tasks, please carefully review the user's crontab tasks. If suspicious crontab tasks exist, delete them.

crontab -e

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None