MYRA RAT Crontab Persistence with */13 Interval (Polymarket Trap)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potentially malicious activity related to cron job scheduling. It monitors for three distinct stages: (1) direct modification of crontab files or directories using common shell utilities, (2) suspicious file write operations to critical cron configuration paths, and (3) execution of shell scripts or binaries from unusual directories (e.g., /tmp, /dev/shm) where the parent process is a cron utility.