이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다.What happened
The cron file {{ @file.path }} was created or modified, potentially for persistence.
Goal
Detect the creation or modification of new cron jobs on a system.
Strategy
Cron is a task scheduling system that runs tasks on a time-based schedule. Attackers can use cron jobs to gain persistence on a system, or even to run malicious code at system-boot. Cron jobs can also be used for remote code execution, or to run a process under a different user-context.
Triage and response
- Check to see which cron task was created or modified.
- Check whether the cron task was created or modified by a known user or process.
- If these changes are not acceptable, roll back the host or container in question to an acceptable configuration.
Requires Agent version 7.27 or greater
