VerdantBamboo BRICKSTORM Cron/RC Script Persistence on Linux/BSD Edge Appliances

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized modifications to cron jobs or RC scripts on Linux and BSD edge appliances, which is a persistence technique observed in the VerdantBamboo BRICKSTORM campaign. The rule flags suspicious file modifications in persistence-related directories, excluding activity from legitimate package managers.