Masjesu .shell Payload Download
Detects suspicious execution of wget or curl retrieving a payload named exactly '/.shell', which matches Masjesu's C2 download pattern. After successfully exploiting a target, the botnet attempts to retrieve this bash shell file to initiate device infection and propagation routines.
CQL
