T1053.003

Official Description

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

An adversary may use <code>cron</code> in Linux or Unix environments to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). In ESXi environments, cron jobs must be created directly via the crontab file (e.g., `/var/spool/cron/crontabs/root`).(Citation: CloudSEK ESXiArgs 2023)

Tactics: Execution, Persistence, Privilege Escalation
Platforms: Linux, macOS, ESXi
Parent Technique: T1053 · Scheduled Task/Job
MITRE Version: 1.3
Last Modified: Oct 24, 2025

View on MITRE ATT&CK ↗

Reported Context (10)

The infection registers cron hooks that can trigger redeployment when system cron runs the WordPress cron file. SC WordPress Malware Uses Self-Rebuilding Loaders and Blockchain-Controlled Backdoor
A Fortinet example log entry shows a cron job executing a command related to /migadmin. Fortinet Warns FortiMail Zero-Day Is Being Actively Exploited
Rogue Redis replication wrote miner-deployment cron entries to victim hosts; recovered QA tooling also tested cron persistence. Redis Cryptomining Botnet Compromised 3,562 Servers, Revealed by Operator’s Exposed Files
The attacker established persistence through cron jobs, including a reinfection cron beacon. Aqua Details Fileless Cryptomining Campaign Targeting Containerized Apps
The torrent-client actor attempted cron-based persistence that checked for the miner every 15 minutes; logs indicated limited success. Talos Details How Adversaries Use AI to Build Malware, Scale Attacks and Steal Credentials

CVE (5)

Malware (10)

People (8)

Threat Actors (2)

MITRE ATT&CK (59)

Vendors (9)

Products (74)

Tools (20)

Industries (3)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.