Crontab Enumeration

Rule Info

Name
Crontab Enumeration
Author
Joseliyo Sanchez, @Joseliyo_Jstnk
Description
Detects usage of crontab to list the tasks of the user
Reference
https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
Date
2023-06-02 00:00:00
Modified
None
Id
403ed92c-b7ec-4edd-9947-5b535ee12d46
Tags
attack.discovery attack.t1007 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=403ed92c-b7ec-4edd-9947-5b535ee12d46

Rule History

Author
Title
Date
Commit
github-actions[bot]
Merge PR #4791 from @nasbench - Promote older rules status from `experimental` to `test`
2024-04-01
a8e1ecd65
jstnk9
feat: new linux rules related to GobRAT malware (#4272)
2023-06-02
04cf7e9ea
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022