• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Linux Motd Persistence Script

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Danny Y@zendannyy
    •updated Mar 8, 2026•1•0•27

    Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users

    YARA

    Tags

    T1037 - Boot or Logon Initialization ScriptsT1059 - Command and Scripting InterpreterTA0003 - PersistenceTA0004 - Privilege EscalationScript ExecutionFile CreationFile ModificationNetwork ConnectionLinuxLinux Auditd

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?