Skip to content

Detection of suspicious crontab creation or modification #1938

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
Apr 27, 2022
Merged

Detection of suspicious crontab creation or modification #1938

merged 6 commits into from
Apr 27, 2022

Conversation

shashank-elastic
Copy link
Contributor

Issues

#1934

Summary

Detects the creation or modification of a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor.

Contributor checklist

@shashank-elastic shashank-elastic added the Rule: New Proposal for new rule label Apr 25, 2022
@shashank-elastic shashank-elastic self-assigned this Apr 25, 2022
@DefSecSentinel DefSecSentinel linked an issue Apr 25, 2022 that may be closed by this pull request
[New Rule] Suspicious CronTab Creation or Modification #1934
Closed
DefSecSentinel
DefSecSentinel reviewed Apr 25, 2022
View reviewed changes
DefSecSentinel
DefSecSentinel approved these changes Apr 25, 2022
View reviewed changes
Copy link
Contributor

@DefSecSentinel DefSecSentinel left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

brokensound77
brokensound77 reviewed Apr 25, 2022
View reviewed changes
brokensound77
brokensound77 reviewed Apr 25, 2022
View reviewed changes
brokensound77
brokensound77 reviewed Apr 25, 2022
View reviewed changes
DefSecSentinel and others added 3 commits April 25, 2022 21:01
@DefSecSentinel @brokensound77
Update rules/macos/persistence_crontab_creation.toml
54bb85d 
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
@DefSecSentinel @brokensound77
Update rules/macos/persistence_crontab_creation.toml
b698884 
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
@DefSecSentinel @brokensound77
Update rules/macos/persistence_crontab_creation.toml
8c601eb 
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
@shashank-elastic shashank-elastic merged commit 88f7123 into main Apr 27, 2022
@shashank-elastic shashank-elastic deleted the issue-1934 branch April 27, 2022 06:38
protectionsmachine pushed a commit that referenced this pull request Apr 27, 2022
@shashank-elastic @github-actions
Detection of suspicious crontab creation or modification (#1938)
d412b4a 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 88f7123)
protectionsmachine pushed a commit that referenced this pull request Apr 27, 2022
@shashank-elastic @github-actions
Detection of suspicious crontab creation or modification (#1938)
ab2fbfa 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 88f7123)
protectionsmachine pushed a commit that referenced this pull request Apr 27, 2022
@shashank-elastic @github-actions
Detection of suspicious crontab creation or modification (#1938)
f3d30e8 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 88f7123)
protectionsmachine pushed a commit that referenced this pull request Apr 27, 2022
@shashank-elastic @github-actions
Detection of suspicious crontab creation or modification (#1938)
1d74816 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 88f7123)
protectionsmachine pushed a commit that referenced this pull request Apr 27, 2022
@shashank-elastic @github-actions
Detection of suspicious crontab creation or modification (#1938)
4ec7b6f 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 88f7123)
protectionsmachine pushed a commit that referenced this pull request Apr 27, 2022
@shashank-elastic @github-actions
Detection of suspicious crontab creation or modification (#1938)
357296b 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 88f7123)
protectionsmachine pushed a commit that referenced this pull request Apr 27, 2022
@shashank-elastic @github-actions
Detection of suspicious crontab creation or modification (#1938)
621eabb 
* Detection of suspicious crontab creation or modification

* Update rules/macos/persistence_crontab_creation.toml

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

* Update rules/macos/persistence_crontab_creation.toml

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

(cherry picked from commit 88f7123)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DefSecSentinel DefSecSentinel DefSecSentinel approved these changes

@Samirbous Samirbous Samirbous approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

+1 more reviewer

@brokensound77 brokensound77 brokensound77 approved these changes

Reviewers whose approvals may not affect merge requirements
Assignees

@shashank-elastic shashank-elastic

Labels
backport: auto Domain: Endpoint OS: macOS Rule: New Proposal for new rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[New Rule] Suspicious CronTab Creation or Modification
4 participants
@shashank-elastic @brokensound77 @DefSecSentinel @Samirbous