VerdantBamboo BRICKSTORM Cron/RC Script Persistence on Linux/BSD Edge Appliances

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects the modification or creation of sensitive Linux files often used for persistence, such as cron job configurations, system boot scripts, and custom system tools. It monitors for file writing and process execution events involving specific paths and filenames identified as associated with persistence mechanisms or monitoring tools.