Miasma GitHub Monitor Persistence

Ethan Andrews@eandrews

•updated Jun 9, 2026•6•0•38

Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.