Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Adds/modifies system service, likely for persistence.

Adding/modifying system rc scripts is a common persistence mechanism.

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Malware can drop malicious files in the shm directory which will run directly from RAM.

Malware often drops required files in the /tmp directory.