Identifier / Programs / Linux and Unix

crontab

Schedule cron jobs to run on a time interval for the current user. tldr-pages

GTFOBins command, inherit 3 Sigma rules name it 1 ATT&CK technique 2 documented commands

How crontab is abused

documented by GTFOBins

command

-e

inherit

-e

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for crontab.

2 documented commands

from GTFOBins, each read by the identifier

command unprivileged, with sudo

This spaws the default editor to edit the crontab file, commands can be scheduled to run using the cron syntax.

crontab -e

Identify

inherit unprivileged, with sudo

crontab -e

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for crontab. The identifier reads the line of each that runs crontab.

What detects it

Sigma process creation rules

lowCrontab EnumerationJoseliyo Sanchez, @Joseliyo_Jstnk

highLinux Webshell IndicatorsFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumScheduled Cron Task/Job - MacOsAlejandro Ortuno, oscd.community

T1007System Service Discovery

Everyday use

from tldr-pages, CC BY 4.0

edit the crontab file for the current user

crontab -eIdentify

Matches GTFOBins abuse: command, inherit

edit the crontab file for a specific user

sudo crontab -e -u userIdentify

Matches GTFOBins abuse: command, inherit

Replace the current crontab with the contents of the given file

crontab path/to/fileIdentify

Of the 3 examples the identifier reads, 2 match GTFOBins abuse or trip a Sigma process-creation rule.

crontab

How crontab is abused

2 documented commands

What detects it

Everyday use

Other programs abused for command