Deprecation Notice (June 30, 2026): This rule is deprecated in favor of the Interactive shell compromise attack correlation rule, which combines multiple interactive shell compromise signals into a single, higher-fidelity detection. You automatically benefit from the improved correlation-based detection without any action required.

What happened

The cron file {{ @file.path }} was modified by {{ @process.comm }}, potentially to establish persistence.

Goal

Detect when a cron job is created by Redis.

Strategy

Cron is a task scheduling system that runs tasks on a time-based schedule. Attackers can use cron jobs to gain persistence on a system, or even to run malicious code at system boot. Cron jobs can also be used for remote code execution, or to run a process under a different user context. An attacker could use the CONFIG SET command to write Redis keys to the cron directory in order to obtain code execution, a known tactic for further compromising Redis clusters.

Triage and response

1. Verify whether or not Redis writing to the cron directory is expected.
2. If not expected, identify what is being executed by the created cron job.
3. Isolate the compromised container, and initiate the incident response plan.

Requires Agent version 7.27 or greater