Node-RED exec dropper: curl/wget payload

ills3c Intel&Coffee@Ills3C

•updated yesterday•5•0•6

Detects behavior where a download utility such as curl or wget downloads and executes a dot-prefixed executable (like .kworker or .sys_update) in the /tmp directory, running detached via nohup. It also covers Node-RED parent process contexts and specific payload server indicators.