Local Job Scheduling Process

On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs.

id:7f490015-20b2-43e3-acf7-e2f2d098505d
categories:enrich
confidence:low
os:macos, linux
created:7/26/2019
updated:7/26/2019

MITRE ATT&CK™ Mapping

tactics:Execution, Persistence
techniques:T1168 Local Job Scheduling

Query

process where subtype.create and
  process_name in ("cron", "at", "launchd")

Contributors