VerdantBamboo BRICKSTORM Cron Persistence on Edge Appliances

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.