Linux Suspicious Cron Persistence
Query
let LinuxDeviceIds =
DeviceInfo
| where OSPlatform == "Linux"
| distinct DeviceId;
DeviceFileEvents
| where DeviceId in (LinuxDeviceIds)
| where Timestamp > ago(7d)
| where FolderPath has_any ("/etc/cron", "/var/spool/cron")
| where InitiatingProcessFileName !in (
"dpkg",
"apt",
"apt-get",
"yum",
"dnf"
)
| project
Timestamp,
DeviceName,
ActionType,
FileName,
FolderPath,
InitiatingProcessFileName,
InitiatingProcessCommandLine
| order by Timestamp descAbout this query
Explanation
This query is designed to detect suspicious cron job activities on Linux systems over the past seven days. It specifically looks for cron files that have been created or modified by processes other than common package management tools like apt, dpkg, yum, or dnf. These package managers are typically responsible for legitimate system updates and maintenance, so excluding them helps focus on potentially malicious activities.
The query identifies activities such as:
- Manual persistence efforts
- Script-based backdoors
- Red team activities
- Post-exploitation footholds
By filtering out expected system behavior, the query aims to highlight human- or script-driven changes, which are often indicative of malicious intent. Examples of suspicious activities include cron jobs created by shell scripts, scheduled execution of payloads, or hidden cron entries.
This query is particularly useful when investigating potential Linux compromises, validating persistence mechanisms after red team exercises, or hunting for subtle backdoors. It is most effective on servers, where cron changes should be rare and deliberate.
To test the query, you can create a temporary cron job and verify its detection, then remove it afterward.
Details
Nathan Hutchinson
Released: February 2, 2026
Tables
Keywords
Operators