CriticalOS hardeningBLWK-ACCT-001

Cron entry runs a downloader piped to a shell

What this means

A cron entry's command (“‹command›”, scheduled “‹schedule›” via ‹source›) pipes a downloaded script straight into a shell. This pattern hides what actually runs, changes on the attacker's schedule, and leaves nothing on disk to inspect between runs.

How to fix it

Review the cron entry, and if unrecognized, remove it and download/inspect the script manually before deciding whether it's legitimate.

Check it yourself

Run a scan and look for BLWK-ACCT-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads cron_entries and reports this check when:

command matches "(curl|wget).*\|\s*(ba)?sh\b"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1053.003

Related checks

• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001
• /etc/shadow is world-readable · BLWK-FS-002