0144-crontab-Crontab Scheduled Task Modified¶

Rule ID¶

• 0144-crontab

Category¶

• system

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• A crontab scheduled task has been added.

Scan Frequency¶

• disable

Rationale¶

• If a crontab scheduled task on a host is modified, it may lead to information security breaches. Therefore, such modifications should be audited.

Risk Items¶

• Hacker intrusion

• Data leakage

• Network security

• Mining risk

• Botnet risk

Audit Method¶

• Verify whether a crontab scheduled task has been modified on the host. You can run the following command to verify:

cat /etc/passwd | cut -f 1 -d : |xargs -I {} crontab -l -u {}

Remediation¶

• If a crontab scheduled task on the host has been modified, carefully review the user's crontab scheduled tasks. If any suspicious tasks are found, delete them.

crontab -e

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• None