T1168 - Test to schedule cron job

red_ttp/schedule_cron.py

@@ -0,0 +1,35 @@
+# Name: Scheduling Local Job with crontab
+# rta: schedule_cron.py
+# ATT&CK: T1168
+# Description: Writes a cron job to a temporary crontab file schedules it for execution.
+
+import os
+import common
+
+CRONTAB_BINARY = '/usr/bin/crontab'
+TMP_CRON = '/tmp/cron_tmp'
+CRON_SCHEDULE = '* * * * * '
+CRON_PAYLOAD = 'bash -c "echo file marker > /tmp/file_marker.txt"'
+
+def main():
+
+    common.log('Writing temporary crontab file...')
+    with open(TMP_CRON,'w') as evil_cron:
+        evil_cron.write(CRON_SCHEDULE + CRON_PAYLOAD + '\n')
+    if os.path.exists(TMP_CRON):
+        common.log('Successfully created temporary crontab file!')
+    else:
+        common.log('Failed to create temporary crontab file.')
+
+    common.log('Replacing current user crontab file...')
+    code, output = common.execute([CRONTAB_BINARY, TMP_CRON],shell=True)
+    if code == 0:
+        common.log('Current user crontab replaced!')
+    else:
+        common.log('Failed to replace current user crontab.')
+
+    common.remove_file(TMP_CRON)
+
+
+if __name__ == "__main__":
+    exit(main())