Scheduled work as a risk.
WHAT TO BE CAREFUL WITH
Scripts with credentials in them Jobs running scripts you did not write Output written to web-accessible locations
THAT LAST ONE
A log file in public_html is downloadable by anyone.
If it contains anything sensitive, that is a disclosure.
Write logs above public_html.
WHAT ATTACKERS DO
A compromised site frequently gains persistence through a cron job.
The site is cleaned, and the job reinstates the compromise.
WHAT TO CHECK AFTER ANY COMPROMISE
The full cron job list.
Anything you did not create should be investigated and removed.
That step is frequently skipped, which is why cleanups fail.
WHAT A MALICIOUS JOB LOOKS LIKE
An obscure path A command downloading and running something Obfuscated content A schedule you did not set
WHAT TO DO
Remove it, then find and close the entry point.
WHAT TO REVIEW PERIODICALLY
The job list, even without a suspected compromise.
