MYRA RAT profile.d login hook persistence via .sh.local and cache-update.sh

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•7

This rule detects the creation or modification of specific script files in common Linux persistence locations: '/etc/profile.d/' or '/usr/local/lib/'. Adversaries may modify or create scripts like '.sh.local' or '.cache-update.sh' in these directories to establish persistence, as these scripts can be executed automatically during system boot or user login.