Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.

Tactics
TA0002 TA0003 TA0004

Sub-technique of
T1053


See: MITRE ATT&CK