crontab persistence

Malware on Linux and Unix-like systems may install malicious cron jobs as a persistence mechanism. This can occur within a specific user’s crontab file, or the system-wide crontab files.

This kind of persistence is usually installed by appending a line to the affected user’s crontab file or with the crontab command.

This technique is cataloged in MITRE ATT&CK: https://attack.mitre.org/techniques/T1053/003/

---