RedisRaider Cron Persistence Attempt

Aaron Mog@AaronMogS2S

•updated May 14, 2025•1•24

Detects attempts by the RedisRaider malware to establish persistence via cron jobs by modifying Redis configuration to write the database to /etc/cron.d. This technique involves setting the 'dir' and 'dbfilename' configuration parameters to target a cron directory and file, followed by a BGSAVE command.