Cron Persistence

Quick notes on using cron for persistence, common locations, and what to look for during enumeration.

2026-09-12

2 min read

linuxpersistencecronenumnerationred-team

Cron Locations#

User crontabs are associated with individual accounts. crontab -l Depending on the system, they are commonly stored under: /var/spool/cron/ /var/spool/cron/crontabs/

System-wide cron jobs can be found in: /etc/crontab /etc/cron.d/ /etc/cron.hourly/ /etc/cron.daily/ /etc/cron.weekly/ /etc/cron.monthly/

cron enumeration

TTY1ZSH 5.9

r41n@0xraiven:~$>crontab -l

r41n@0xraiven:~$>sudo crontab -l

r41n@0xraiven:~$>ls -la /etc/cron.d/

r41n@0xraiven:~$>cat /etc/crontab

r41n@0xraiven:~$>

Findings

INFO

Suspicious Cron Jobs : Look for: • Jobs you don't recognize • Scripts stored in unusual locations • Commands running from /tmp or user-writable directories • Unexpected network commands • Jobs running with elevated privileges • Recently modified cron files

PersistHunt Cron is one of PersistHunt's persistence detection surfaces. The goal is to identify unusual scheduled execution and provide enough context for further investigation.

Example#

example cron entry

TTY1ZSH 5.9

r41n@0xraiven:~$>cat /etc/cron.d/example

*/5 * * * * user /opt/scripts/backup.sh

r41n@0xraiven:~$>

This entry executes a script every five minutes. The schedule itself isn't malicious, so the next step is to inspect the referenced script, its ownership, permissions, and whether the job is expected.

Takeaway#

Cron persistence is simple but easy to overlook. During Linux enumeration, always check both user and system-wide scheduled jobs.

Back to Notesnote: cron-persistence