title: Modifying Crontab
id: af202fd3-7bff-4212-a25a-fb34606cfcbe
status: experimental
description: Detects suspicious modification of crontab file.
# log example: Apr 16 11:18:18 localhost CROND[3333]: (user) REPLACE (user)
author: Pawel Mazur
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.003/T1053.003.md
date: 2022/04/16
logsource:
    product: linux
    service: cron
detection:
    keywords: 
        - 'REPLACE'
    condition: keywords
falsepositives:
   - Legitimate modification of crontab
level: medium
tags:
   - attack.persistence
   - attack.t1053.003