Skip to content

P3: Add scheduled task / cron enumeration tool (MITRE T1053) #171

@Shreyas582

Description

@Shreyas582

Description

Scheduled tasks / cron jobs are one of the most common persistence mechanisms (MITRE T1053). The current check_persistence tool does basic detection but does not enumerate scheduled tasks in detail.

On Windows, schtasks /query is needed; on Linux, crontab -l plus /etc/cron.* directories.

Proposal

Add a list_scheduled_tasks tool that:

  1. On Windows: runs schtasks /query /fo CSV /v and parses results
  2. On Linux: reads crontab -l for all users + /etc/cron.* directories
  3. Flags tasks with suspicious characteristics (running as SYSTEM, recently created, pointing to temp dirs)
  4. Returns structured output with task name, schedule, command, user, status

Affected Files

  • cyber_tools/src/lib.rs (new tool)
  • core_engine/src/lib.rs (tool registry, priv-esc-review template)

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:toolsCyber tools, tool registry, and host introspectionenhancementNew feature or requestlive-testing-auditFrom v1.6.0 live-mode comprehensive testingpriority:p3Priority: P3 - Nice to have

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions