CVE-2026-59310 - VMware vCenter Suspicious Syslog File Written to Cron Directory
Identifies the creation or modification of files within /etc/cron.d that exhibit suspicious naming conventions, including references to syslog, .log extensions, 59310, or known filenames such as zz-poc59310-syslog.log. The rule is intended to detect potential abuse of the cron scheduling mechanism for persistence, particularly where attackers disguise cron entries as legitimate log files to evade detection.
Microsoft Sentinel (KQL)
