Redis Config Set Dir Crond

Detects a Redis CONFIG SET dir /etc/cron.d command, which changes the Redis working directory to the system cron directory. This is a well-known exploitation technique used after gaining write access to an exposed Redis instance. By redirecting the dump directory to /etc/cron.d, attackers can subsequently use SAVE or BGSAVE to write a malicious cron file to disk, achieving persistent command execution on the host.