MYRA RAT cron persistence via .cache-update.sh at */13 interval

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects suspicious cron utility activity, including modifications or executions, with specific indicators associated with the MYRA malware family. This rule identifies attempts to establish persistence or execute malicious code via scheduled tasks on Linux systems.