attack.t1053.003

Triple Cross eBPF Rootkit Default Persistence

Apr 28, 2026 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

New Cron File Created

Apr 27, 2026 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·

Share on:

Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.

Modifying Crontab

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.t1053.003 ·

Share on:

Detects suspicious modification of crontab file.

Azure Kubernetes CronJob

Aug 12, 2024 · attack.persistence attack.t1053.003 attack.privilege-escalation attack.execution ·

Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Scheduled Cron Task/Job - Linux

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·

Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Scheduled Cron Task/Job - MacOs

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.t1053.003 ·

Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.