Cron is the Linux job scheduler used to run commands or scripts at specific times or intervals. Administrators rely on it for routine tasks such as backups, log cleanup, and maintenance checks. Cron jobs are defined in user crontabs or system-wide configuration files, and each entry tells the system what to run and when.
In cyber security, cron matters because it is a common persistence mechanism. An attacker who gains access may add a hidden cron entry to restart malware, open a reverse shell, or reapply changes after reboot. Defenders inspect cron configurations during compromise investigations to find unknown jobs, suspicious scripts, and references to unusual paths or binaries. Reviewing cron is also useful for spotting abuse of legitimate automation, since malicious entries often blend in with normal scheduled maintenance.