Menorah Backdoor Detection via MSIL Bytecode Patterns

This rule detects the Menorah backdoor by identifying specific bytecode patterns related to its functionality. The patterns indicate capabilities such as sending system fingerprints to a command and control (C2) server, enumerating files and directories, and uploading files to the C2 server. The rule specifically targets .NET bytecode (MSIL) and requires all three sets of patterns to be present for a match, reducing false positives.