LoFP / legitimate use of crontab

Techniques

• t1007

Sample rules

Crontab Enumeration

• source: sigma
• technicques:
  • t1007

Description

Detects usage of crontab to list the tasks of the user

Detection logic

condition: selection
selection:
  CommandLine|contains: ' -l'
  Image|endswith: /crontab