Redis modified cron job directory to execute commands

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.


Detect when a cron job is created by Redis.


Cron is a task scheduling system that runs tasks on a time-based schedule. Attackers can use cron jobs to gain persistence on a system, or even to run malicious code at system boot. Cron jobs can also be used for remote code execution, or to run a process under a different user context. An attacker could use the CONFIG SET command to write Redis keys to the cron directory in order to obtain code execution, a known tactic for further compromising Redis clusters.

Triage and response

  1. Verify whether or not Redis writing to the cron directory is expected.
  2. If not expected, identify what is being exceuted by the created cron job.
  3. Isolate the compromised container, and initiate the incident response plan.

Requires Agent version 7.27 or greater