In order: minute (0–59), hour (0–23), day of month (1–31), month (1–12 or JAN–DEC) and day of week (0–6 or SUN–SAT, where both 0 and 7 mean Sunday). Each accepts *, a single value, a range (1-5), a list (1,3,5) and a step (*/15).
Why does "0 0 1 * MON" run more often than I expect?
Because of a rule that surprises nearly everyone: when BOTH the day-of-month and day-of-week fields are restricted, cron fires if EITHER matches — not both. So that expression runs on the 1st of every month AND on every Monday. If you need "the first Monday", cron alone cannot express it; you have to check the date inside your job.
Which timezone does cron use?
Whatever the machine or scheduler is configured with, and this is a common source of production incidents. System crontab typically uses the server's local time, which means jobs shift by an hour twice a year under daylight saving — and a 2:30am job may run twice or not at all on the transition days. Running schedulers in UTC avoids the whole class of bug.
Are shorthand aliases supported?
Yes — @hourly, @daily, @midnight, @weekly, @monthly and @yearly/@annually are all accepted and expanded to their five-field equivalents.