MYRA RAT Cron Persistence Every 13 Minutes or Prime-Interval to World-Writable Path

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects potentially malicious cron job activity, including modifications to crontab files, execution of cron jobs from world-writable directories (such as /tmp or /dev/shm), and the usage of unusual prime-number timing intervals which are commonly used by attackers to evade standard scheduling patterns.