Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1053.003

T1053.003Cron

T1053.003 — Cron is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 20 detection use cases covering it and 8 threat-intel articles citing it.

ExecutionPersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
20Use cases
8Articles
0Sub-techniques
3Tactics
↑ Parent technique: T1053 · Scheduled Task/Job

Use cases covering this technique (20)

[WEEKLY] Web-Facing Service Process Writes to RCE/Persistence Paths (Path-Traversal File-Write) Internal install · alerting DSΣPDDCS Cisco Isovalent - Cron Job Creation ESCU actions · hunting P Linux Add Files In Known Crontab Directories ESCU actions · hunting P Linux Adding Crontab Using List Parameter ESCU actions · hunting P Linux At Allow Config File Creation ESCU actions · hunting P Linux Auditd Edit Cron Table Parameter ESCU actions · hunting P Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File ESCU actions · hunting P Linux Edit Cron Table Parameter ESCU actions · hunting P Linux Possible Append Cronjob Entry on Existing Cronjob File ESCU actions · hunting P Linux Possible Cronjob Modification With Editor ESCU actions · hunting P Cisco Secure Firewall - Wget or Curl Download ESCU actions · hunting P [LLM] Recurring cron/shell-rc execution of .tf_cache/hw_probe.pyc payload Bespoke install · alerting DSΣPDDCS [LLM] redis-server writes to persistence paths (cron / SSH authorized_keys / systemd) Bespoke install · alerting DSΣPCS [LLM] SleeperGem persistence: git-credential-manager daemon installs systemd + cron Bespoke install · alerting DSΣPDDCS [LLM] SleeperGem Unix persistence: cron/systemd/LaunchAgent write by Ruby-descended shell Bespoke install · hunting DSΣPDDCS [LLM] Siemens ROX II root cron table injection via web task scheduler (CVE-2025-40949) Bespoke install · hunting DSΣDD [LLM] Anyquery process writing files to cron/webroot/SSH persistence paths (ATTACH DATABASE AFW) Bespoke install · alerting DSΣPCS [LLM] Reverse shell via cron/webshell payload dropped through Anyquery AFW (/dev/tcp) Bespoke c2 · alerting DSΣPDDCS [LLM] Node archive-extraction process writing to Linux persistence paths (decompress dir-escape) Bespoke install · hunting DSΣDDCS [LLM] Atomic Arch persistence: systemd unit, cron or shell-rc written by AUR build / JS runtime Bespoke install · hunting DSΣPCS

Articles citing this technique (8)

crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-77
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105
high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-140
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-141
crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-145
crit [GHSA / CRITICAL] CVE-2026-50006: Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTA art-176
crit [GHSA / CRITICAL] CVE-2026-53486: Decompress: Archive extraction can create files and links outside of the target directory art-239
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-316