MYRA RAT Cron Persistence Every 13 Minutes via /etc/profile.d/.sh.local

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects MYRA Linux RAT persistence mechanisms. The rule monitors for the creation of cron jobs scheduled to run every 13 minutes and the creation of a profile initialization script at /etc/profile.d/.sh.local, which is a common technique for ensuring code execution upon user shell session initialization.