Scheduled Tasks
Automate execution. Configure beacons. Set dead man switches.
CLASSIFIED SCENARIO
Your implant needs to beacon to the handler every 6 hours without manual intervention. Additionally, you must configure a "dead man switch" - if you don't check in within 24 hours, an alert is triggered. Master cron scheduling to automate these critical operations.
Why Scheduled Tasks Matter
Cron is the heartbeat of automated operations. Understanding task scheduling enables:
- Automated beacons - Regular check-ins to C2 infrastructure
- Data exfiltration - Scheduled uploads of collected intel
- Dead man switches - Alerts if operator doesn't check in
- Persistence - Tasks survive reboots (cron runs on boot)
- Evasion - Schedule activity during low-monitoring periods
Tactical Use of Cron
- Off-hours execution - Run tasks at 3 AM when admins sleep
- Random intervals - Avoid predictable patterns
- Output suppression - Use >/dev/null 2>&1
- Path specification - Cron has minimal PATH
- Log clearing - Schedule periodic cleanup
Cron Time Format
Cron uses a 5-field time specification:
| Minute | Hour | Day of Month | Month | Day of Week |
|---|---|---|---|---|
| 0-59 | 0-23 | 1-31 | 1-12 | 0-7 (0,7=Sun) |
# Examples
* * * * * # Every minute
0 * * * * # Every hour (at minute 0)
0 3 * * * # Daily at 3:00 AM
0 */6 * * * # Every 6 hours
0 0 * * 0 # Every Sunday at midnight
*/15 * * * * # Every 15 minutes
Command Deep Dive
crontab -l - List Your Jobs
$ crontab -l
# m h dom mon dow command
0 */6 * * * /opt/beacon.sh >/dev/null 2>&1
0 3 * * * /usr/local/bin/cleanup.sh
[INFO] Two cron jobs configured
[BEACON] Runs every 6 hours, output suppressed
[CLEANUP] Runs daily at 3 AM
crontab -e - Edit Your Jobs
$ crontab -e
# Opens crontab in default editor (usually vi/nano)
# Add new line:
0 */6 * * * /opt/beacon.sh >/dev/null 2>&1
# Save and exit
crontab: installing new crontab
[INSTALLED] New cron job active
[OPSEC] Output redirected to /dev/null - no mail alerts
System Cron Directories
$ ls /etc/cron.*
/etc/cron.d:
logrotate sysstat
/etc/cron.daily:
apt-compat logrotate man-db
/etc/cron.hourly:
suspicious-script
/etc/cron.weekly:
fstrim man-db
[ALERT] Unknown script in cron.hourly!
[INVESTIGATE] /etc/cron.hourly/suspicious-script
at - One-Time Scheduled Task
$ echo "/opt/deadman.sh" | at now + 24 hours
warning: commands will be executed using /bin/sh
job 42 at Mon Jan 15 04:30:00 2024
[SCHEDULED] Dead man switch set for 24 hours
[OPSEC] If operator doesn't check in, script triggers
Quick Reference
| Command | Purpose | Notes |
|---|---|---|
crontab -l | List your cron jobs | User-specific jobs |
crontab -e | Edit your cron jobs | Opens in $EDITOR |
crontab -r | Remove all your jobs | Caution: no confirmation |
sudo crontab -u user -l | List another user's jobs | Requires root |
at time | Schedule one-time task | at now + 1 hour |
atq | List at queue | Shows pending at jobs |
Beacon Schedule Example
# === OPERATOR BEACON SCHEDULE ===
$ crontab -e
# Add these lines:
# Beacon to handler every 6 hours
0 */6 * * * /opt/.hidden/beacon.sh >/dev/null 2>&1
# Daily log cleanup at 3 AM
0 3 * * * /opt/.hidden/cleanup.sh >/dev/null 2>&1
# Weekly exfil on Sunday at 2 AM
0 2 * * 0 /opt/.hidden/exfil.sh >/dev/null 2>&1
[OPSEC] All output suppressed
[OPSEC] Scripts in hidden directory
Ready to Automate Operations?
Test your scheduling skills, then configure the beacon system.
Tier 5: OPERATOR - Remote Operations