Mirai Bot Artifacts: /dev/shm/.comm File Creation and Watchdog Device Access
Detects Linux file and process activity associated with Mirai botnet variants, specifically the creation of the hidden shared-memory file /dev/shm/.comm or processes that interact with hardware watchdog devices (/dev/watchdog, /dev/misc/watchdog) outside of known legitimate watchdog daemons.
Sigma
