Mirai l.sh dropper downloading hidden .b binary via wget/curl and executing it
Detects Linux process creation where a shell script or command downloads a hidden binary named .b using wget or curl, changes its permissions to executable, and executes it in the background, matching behavior typical of the Mirai malware l.sh dropper.
Sigma
