Identify Suspicious Cron Jobs
Cron jobs are scheduled commands that run automatically at specified intervals. Malicious actors often use these to maintain persistence. Here's how to check for unusual entries.
- Examine your user-specific cron jobs using
crontab -l. Look for unfamiliar scripts or commands. - Inspect system-wide cron jobs in
/etc/crontaband/etc/cron.d/. Pay attention to any recently modified files. - Review the contents of
/etc/cron.hourly/,/etc/cron.daily/,/etc/cron.weekly/, and/etc/cron.monthly/for suspicious scripts. - Check for cron jobs disguised as legitimate system tasks, often with random-looking filenames or unusual execution times.
- Use a command like
grep -r 'CRON' /var/log/syslog(or/var/log/messageson some systems) to review recent cron activity.
Tip
Regularly backing up your system configuration can help you revert unwanted changes easily.
Identify Suspicious systemd Services
systemd manages system services on many modern Linux distributions. Malicious services can run continuously and hide their activities. Let's find them.
- List all running services with
systemctl list-units --type=service --state=running. Look for services with unusual names or descriptions. - Inspect all enabled services using
systemctl list-unit-files --type=service --state=enabled. Cross-reference these with known legitimate services. - Examine the contents of service unit files for suspicious services. These are typically located in
/etc/systemd/system/and/usr/lib/systemd/system/. - Look for services that start custom scripts or executables from unusual directories (e.g.,
/tmp/or hidden directories). - Check the timestamps of unit files in systemd directories for recent, unexpected modifications.
Important
Disabling or removing critical system services can render your system unusable, so proceed with caution.
Safely Disable and Remove Malicious Cron Jobs
Once identified, malicious cron jobs need to be disabled and removed. We'll start with the least destructive steps.
- For user cron jobs: Edit your crontab with
crontab -eand either delete the suspicious line or comment it out by adding a#at the beginning. - For system-wide cron jobs: Edit the relevant file in
/etc/crontabor/etc/cron.d/using a text editor (e.g.,sudo nano /etc/crontab). Delete or comment out the malicious entry. - For scripts in cron directories: Move suspicious scripts from
/etc/cron.hourly/,/etc/cron.daily/, etc. to a quarantine directory (e.g., a new/tmp/quarantine/directory) rather than deleting them immediately. - Verify that the rogue cron job is no longer active by checking system logs after the supposed execution time.
Good to know
Always make a backup of any file before modifying it, especially system configuration files.
Safely Disable and Remove Malicious systemd Services
Removing malicious systemd services requires careful steps to prevent system issues. Follow these steps to disable and then remove them.
- Stop the malicious service: Use
sudo systemctl stop [service_name]. Replace[service_name]with the actual name of the service. - Disable the service: Prevent it from starting on boot with
sudo systemctl disable [service_name]. - Remove the service unit file: Delete the
.servicefile from/etc/systemd/system/or/usr/lib/systemd/system/(e.g.,sudo rm /etc/systemd/system/[service_name].service). - Reload systemd: After deleting a unit file, run
sudo systemctl daemon-reloadto make systemd aware of the changes. - Remove associated files: Delete any scripts or executables that the malicious service was configured to run. Check directories like
/bin/,/usr/local/bin/,/opt/, or hidden directories in user home folders. - Verify the service is no longer present by attempting to start it or checking
systemctl list-unit-files.
Important
Ensure you have a system recovery plan in place should any critical system services be inadvertently affected.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers