Threat intelligence / Technique

Cron

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths. An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths. An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)

19 recorded

Relationships

mitigates

from Audit

Mitigation

mitigates

from User Account Management

Mitigation

subtechnique-of

to Scheduled Task/Job

Technique

uses

Malware

uses

from APT38

Group

uses

from APT5

Group

uses

from Exaramel for Linux

Malware

uses

Malware

uses

from Gomir

Malware

uses

Malware

uses

Malware

uses

Malware

uses

Malware

uses

from Operation MidnightEclipse

Campaign

uses

Malware

uses

from Rocke

Group

uses

Malware

uses

Malware

uses

from Xbash

Malware

3 external

References

mitre-attack

T1053.003

CloudSEK ESXiArgs 2023

https://www.cloudsek.com/blog/analysis-of-files-used-in-esxiargs-ransomware-attack-against-vmware-esxi-servers

20 macOS Common Tools and Techniques

https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/