Cron Persistence Entry Written via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.