| elastic |
Executable Bit Set for Potential Persistence Script |
production |
2026-09-18 |
| elastic |
Cron Job Created or Modified |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Suspicious Network Activity to the Internet by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Root Crontab File Modification |
production |
2026-09-18 |
| elastic |
Potential Persistence via Periodic Tasks |
production |
2026-09-18 |
| elastic |
Suspicious CronTab Creation or Modification |
production |
2026-09-18 |
| splunk |
Linux Crontab Enumeration |
production |
2026-09-03 |
| splunk |
Linux Possible Append Cronjob Entry on Existing Cronjob File |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Cron Job Creation |
production |
2026-05-13 |
| splunk |
Linux Add Files In Known Crontab Directories |
production |
2026-05-13 |
| splunk |
Linux At Allow Config File Creation |
production |
2026-05-13 |
| splunk |
Linux Auditd Edit Cron Table Parameter |
production |
2026-05-13 |
| splunk |
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File |
production |
2026-05-13 |
| splunk |
Linux Edit Cron Table Parameter |
production |
2026-05-13 |
| splunk |
Linux Possible Cronjob Modification With Editor |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Wget or Curl Download |
production |
2026-05-13 |
| sigma |
New Cron File Created |
experimental |
2026-04-28 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| sigma |
Triple Cross eBPF Rootkit Default Persistence |
test |
2022-12-31 |
| sigma |
Azure Kubernetes CronJob |
test |
2022-12-18 |
| sigma |
Scheduled Cron Task/Job - Linux |
test |
2022-11-27 |
| sigma |
Scheduled Cron Task/Job - MacOs |
test |
2022-11-27 |
| sigma |
Modifying Crontab |
test |
2022-04-16 |
| elastic |
Potential Persistence via Cron Job |
deprecated |
2021-04-15 |