Nexcorium Mirai Variant 'sysd' Masquerading
Detects the creation of an executable file named 'sysd' in the '/usr/local/bin/' directory on Linux systems. The Nexcorium Mirai variant copies itself to this location to masquerade as a legitimate system process for persistence. This specific file name is not a standard Linux system daemon.
CQL
