Cron Jobs

Location

Description

Scheduled task definitions across system-wide crontab, the cron.d drop-in directory, and per-user crontabs. Each entry specifies a schedule, user context, and command to execute.

Forensic Value

Cron is the most common Linux persistence mechanism. Attacker cron entries typically download and execute payloads from external URLs, restart reverse shells at intervals, or run cryptominers. Checking /var/spool/cron/crontabs/ for all users reveals per-user entries that do not appear in the system-wide crontab. File modification timestamps on cron files help establish when persistence was installed.

Tools Required