Redis Config Set Dbfilename Custom

Detects a Redis CONFIG SET dbfilename <name> command where the RDB snapshot filename is changed to a custom value (e.g., zzh). This behavior is commonly observed during Redis exploitation chains, where an attacker first modifies the working directory (e.g., to /etc/cron.d, /root/.ssh/, or /var/spool/cron/) and then changes the dump filename so that a subsequent SAVE or BGSAVE writes attacker-controlled content to a sensitive path. On its own, changing dbfilename indicates preparatory filesystem manipulation. In sequence with CONFIG SET dir and SAVE, it strongly signals an attempt to achieve persistence or privilege escalation via cron job injection or SSH authorized_keys overwrite.