Cron Jobs

Overview

Evidence: Cron Jobs Description: Collect Cron Jobs Category: System Platform: macos Short Name: cronj Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

This collector gathers cron jobs information from the macOS system. This data is essential for understanding system activity, detecting persistence, and investigating scheduled task misuse.

Data Collected

This collector gathers structured data about cron jobs.

Cron Jobs Data

Field	Description	Example
Event	Event	Example value
Minute	Minute	Example value
Hour	Hour	Example value
DayOfMonth	Day Of Month	Example value
Month	Month	Example value
DayOfWeek	Day Of Week	Example value
Command	Command	Example value
Path	Path	Example value

Collection Method

This collector queries the crontab table via osquery; if a path is present for an entry, the underlying file is collected.

Forensic Value

This evidence is crucial for forensic investigations as it reveals scheduled tasks that can indicate persistence mechanisms, data exfiltration schedules, or malicious automation.