BeyondTrust Appliance - Cron Job Persistence
Detects creation or modification of cron entries on the BeyondTrust Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth vulnerability, attackers establish recurring execution for persistence and C2 beaconing via cron (T1053.003) on the Linux-based appliance. Follows CISA's urgent patch advisory for BeyondTrust appliances.
YARA-L
