crontab is the file or command interface used to create and manage cron jobs for a user or for the system. A cron job is a scheduled task that runs at a set time or interval on Linux and Unix systems. Administrators use it for backups, maintenance, and automation.
In cyber security, crontab matters because attackers often abuse it for persistence. If a malicious line is added, a loader, miner, or backdoor can relaunch after reboot or after a defender kills the process. Security teams inspect crontab entries when investigating unexplained CPU use, repeated process reappearance, or unauthorized scripts. Defenders should review user and system crontabs, look for unfamiliar commands, and restrict who can modify scheduled tasks.