VerdantBamboo BRICKSTORM: Edge Appliance Cron/RC Persistence (ssync, blacklist)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•6

Detects indicators of persistence on Linux systems, specifically targeting unauthorized cron job creation/deletion in /etc/cron.d/, execution of suspicious shell scripts (ssync.sh), modification of startup scripts (e.g., /etc/rc.d/cron), and execution of binaries from world-writable directories by cron or system daemons. This rule is designed to identify the footprint of known Linux-based persistence mechanisms associated with service account exploitation.