The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

check running/scheduled cron jobs

Description: looks for run any running or scheduled cron jobs on linux hosts.

What The Data Shows: allows analyst to look for any unauthorized cron jobs, unauthorized cron jobs could be a compliance violation, or even a compromise from an attacker, used for persistence 

SQL: 

SELECT * FROM (`crontab`);

 

0 Votes
3 Comments
jnelson
Carbon Black Employee
Status changed to: Under Review

@coreymaygard is there a reason you did not just do a SELECT *?

coreymaygard
New Contributor III

updated

jnelson
Carbon Black Employee
Status changed to: Approved