MYRA RAT cron persistence via node.exe spawning crontab with */13 interval

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where a Node.js process spawns the 'crontab' utility, likely to modify user cron jobs. This is a common technique used by attackers to achieve persistence by scheduling periodic execution of malicious scripts or reverse shells.