JDY Botnet Shell/Bash Execution and Log Deletion on Linux SOHO/IoT Devices
Detects suspicious command execution on Linux-based SOHO/IoT devices, specifically targeting patterns associated with log deletion, unauthorized cron job modification, busybox utility abuse, and temporary directory execution. This activity is often linked to botnet recruitment and reconnaissance behaviors such as those observed in the JDY and Volt Typhoon campaigns.
Microsoft Sentinel (KQL)
