Goal

Detect when a cron job is created by Redis.

Strategy

Cron is a task scheduling system that runs tasks on a time-based schedule. Attackers can use cron jobs to gain persistence on a system, or even to run malicious code at system boot. Cron jobs can also be used for remote code execution, or to run a process under a different user context. An attacker could use the CONFIG SET command to write Redis keys to the cron directory in order to obtain code execution, a known tactic for further compromising Redis clusters.

Triage and response

1. Verify whether or not Redis writing to the cron directory is expected.
2. If not expected, identify what is being exceuted by the created cron job.
3. Isolate the compromised container, and initiate the incident response plan.

Requires Agent version 7.27 or greater