Built off the open source project Osquery
Description: looks for run any running or scheduled cron jobs on linux hosts.
What The Data Shows: allows analyst to look for any unauthorized cron jobs, unauthorized cron jobs could be a compliance violation, or even a compromise from an attacker, used for persistence
SQL:
SELECT * FROM (`crontab`);
Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.