All Detections

Linux Cron Persistence or IRC C2

avatar
Daniel Jeremiah@daniyyell
updated Feb 28, 2026029

Detects Linux cron persistence, log tampering, outbound IRC ports, or compiler use from temp paths, matching SSHStalker botnet tradecraft.

Sigma