Detects the use of crontab -l to enumerate a user’s Linux crontab entries, a common step attackers take to identify persistence mechanisms, scheduled tasks, or privilege escalation opportunities. While crontab -l is legitimate administrator activity, the analytic focuses on process execution telemetry to identify potential abuse. The rule targets the Linux Crontab enumeration pattern by inspecting endpoint process data for crontab with a -l argument, and surfaces relevant metadata (action, destination, original_file_name, parent_process, user, process, etc.) to aid investigation. It leverages data from EDR telemetry and normalizes fields to the Endpoint-CIM data model for efficient querying in Splunk. The detection is tied to MITRE technique T1053.003 (Scheduled Task / Linux Cron). Implementation assumes ingestion of complete command lines and mapping to the Processes node; CIM normalization is recommended for speed and consistency. False positives can arise from legitimate administrative use, so filter tuning on user, parent process, and environment is advised. The rule includes references to related campaigns and techniques (Linux Privilege Escalation, Linux Living Off The Land, Scheduled Tasks, and related malware scenarios) and provides unit tests with true-positive datasets to validate the detection across Sysmon for Linux and process execution telemetry from Cisco Isovalent.