Redundant Linux persistence via APT hook, profile.d script, or cron.d xminer ent

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•4

This rule detects multiple suspicious file write operations on a Linux host, specifically targeting directories often used for persistence such as /etc/apt/apt.conf.d, /etc/profile.d, and /etc/cron.d. The rule flags hosts where at least two of these specific persistence techniques are utilized within a 24-hour window, which is indicative of an automated, redundant persistence strategy often employed by cryptocurrency miners like XMRig.