Mirai Bot Process Running From Deleted Executable on Linux
Detects Linux process activity where the executable image is reported with a (deleted) tag, or where a hidden dropper binary (.b) is executed from a world-writable staging directory and removed. Mirai variants unlink their own binary after launch and keep running from the deleted file to hinder forensics.
Sigma
