Overview
Wazuh - Cron Job Persistence Analysis is a SOC lab about detecting suspicious scheduled task activity on Linux systems.
Cron is normal administrative infrastructure, which makes it attractive for persistence. The analyst needs to look at what changed, which user or path is involved, when the change happened, and whether the schedule aligns with legitimate operations.
This lab is useful for practicing endpoint alert triage, persistence investigation, and the difference between normal automation and attacker-controlled scheduled execution.
Related Labs
Related trainings
