T1053.003Cron
T1053.003 — Cron is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 21 detection use cases covering it and 8 threat-intel articles citing it.
ExecutionPersistencePrivilege Escalation
21Use cases
8Articles
0Sub-techniques
3Tactics
↑ Parent technique: T1053 · Scheduled Task/Job
Use cases covering this technique (21)
[WEEKLY] Web-Facing Service Process Writes to RCE/Persistence Paths (Path-Traversal File-Write) Cisco Isovalent - Cron Job Creation Linux Add Files In Known Crontab Directories Linux Adding Crontab Using List Parameter Linux At Allow Config File Creation Linux Auditd Edit Cron Table Parameter Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File Linux Edit Cron Table Parameter Linux Possible Append Cronjob Entry on Existing Cronjob File Linux Possible Cronjob Modification With Editor Cisco Secure Firewall - Wget or Curl Download [LLM] vCenter CVE-2026-59310 PoC cron drop + backdoor fetch (zz-poc59310-syslog.log) [LLM] VMware-impersonating cron jobs drop JSP webshell (vmware-perf-update.jsp) [LLM] Evooo1Bot persistence: 5-min cron re-download & 'Apache HTTPD Cache Manager' systemd masquerade [LLM] Recurring cron/shell-rc execution of .tf_cache/hw_probe.pyc payload [LLM] SleeperGem persistence: git-credential-manager daemon installs systemd + cron [LLM] SleeperGem Unix persistence: cron/systemd/LaunchAgent write by Ruby-descended shell [LLM] Siemens ROX II root cron table injection via web task scheduler (CVE-2025-40949) [LLM] Anyquery process writing files to cron/webroot/SSH persistence paths (ATTACH DATABASE AFW) [LLM] Reverse shell via cron/webshell payload dropped through Anyquery AFW (/dev/tcp) [LLM] Atomic Arch persistence: systemd unit, cron or shell-rc written by AUR build / JS runtimeArticles citing this technique (8)
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28