Cron Jobs & Periodic Scripts
Location
/usr/lib/cron/tabs/ (user crontabs), /etc/crontab, /etc/periodic/ (daily/weekly/monthly)Description
macOS supports both traditional cron job scheduling via crontab and the periodic system that runs maintenance scripts at daily, weekly, and monthly intervals via launchd. User crontabs are stored in /usr/lib/cron/tabs/ and system-wide tasks in /etc/crontab. The periodic directories contain shell scripts executed by the com.apple.periodic-* LaunchDaemons.
Forensic Value
While LaunchAgents and LaunchDaemons are the dominant macOS scheduling mechanisms, cron jobs remain functional and are used by attackers who are more familiar with Linux persistence techniques. User crontabs in /usr/lib/cron/tabs/ may contain entries that download and execute payloads from external URLs. Scripts added to /etc/periodic/daily/ execute as root once per day and can fly under the radar because administrators expect files in these directories. File modification timestamps and content analysis of periodic scripts identify unauthorized additions.