T1168M - Local Job Scheduling

[daniel-infosec]

Three methods

Method 1

Name	Description	Type	Default Value
command	Command to execute	string	/tmp/evil.sh
tmp_cron	Temporary reference file to hold evil cron schedule	path	/tmp/persistevil

echo "* * * * * #{command}" > #{tmp_cron} && crontab #{tmp_cron}

Create a sh file that will write t1168m to a file /tmp/t1168m.txt

Method 2

echo "#{command}" > /etc/cron.daily/#{cron_script_name}

Source:
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1168/T1168.md