2022-10-14 18:19:13 +00:00
|
|
|
-- Unexpected crontab entries
|
|
|
|
|
--
|
|
|
|
|
-- references:
|
2022-10-19 20:56:32 +00:00
|
|
|
-- * https://attack.mitre.org/techniques/T1053/003/ (Scheduled Task/Job: Cron)
|
2022-10-14 18:19:13 +00:00
|
|
|
--
|
|
|
|
|
-- false positives:
|
|
|
|
|
-- * crontab entries added by the user
|
|
|
|
|
--
|
2022-10-14 18:26:49 +00:00
|
|
|
-- tags: persistent filesystem state
|
2022-10-14 18:19:13 +00:00
|
|
|
-- platform: posix
|
2022-09-24 15:12:23 +00:00
|
|
|
SELECT
|
|
|
|
|
*
|
|
|
|
|
FROM
|
|
|
|
|
crontab
|
|
|
|
|
WHERE
|
2022-10-13 18:59:32 +00:00
|
|
|
command NOT LIKE 'root%run-parts%'
|
|
|
|
|
AND command NOT LIKE '%freshclam%'
|
|
|
|
|
AND command NOT LIKE '%clamscan%'
|
|
|
|
|
AND command NOT LIKE '%e2scrub%'
|
|
|
|
|
AND command NOT LIKE '%zfs-linux%'
|
|
|
|
|
AND command NOT LIKE '%anacron start%'
|
|
|
|
|
AND command NOT LIKE '%/usr/lib/php/sessionclean%'
|
2022-11-18 15:27:43 +00:00
|
|
|
AND command NOT LIKE 'root command -v debian-sa1%'
|
