Suspicious Script Creation in Persistence-Related Directories

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•7

Detects the creation or modification of shell script files within known Linux system persistence directories ('/etc/profile.d/' and '/usr/local/lib/') that contain specific naming patterns (' .sh.local' or '.cache-update.sh'). This activity often indicates an attempt to establish persistence or inject code that executes upon user logon or system initialization.