Malicious cron.d file dropped via Redis-injected persistence

Arnold Chan@slaz

•updated Sep 20, 2026•0•0•1

This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.