Linux MOTD Script Added — Detection Rule
The following analytic detects the creation of a file within the /etc/update-motd.d directory. This is used to add scripts that run with Message of the Day (MOTD) when a user logs in. This can be used by attackers for persistence if it contains malicious code.