MYRA RAT Cron Persistence: */13 Schedule and Suspicious Cron-Spawned Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects suspicious execution patterns originating from or associated with crontab, crond, or anacron processes. The rule identifies potential persistence or malicious task scheduling by monitoring specific command-line indicators such as execution from /tmp or /dev/shm, unusual execution intervals, or specific shell command patterns associated with cron job abuse.