Linux BiBiWiper Trojan Detection

This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.