Suterusu Rootkit Source Code Detection

This rule detects the presence of source code files associated with the Suterusu Rootkit. It looks for specific function definitions ('hijack_start', 'hijack_pause', 'hijack_resume', 'hijack_stop') typically found in 'common.h', print strings related to rootkit functionality ('Dropping to root shell', 'Hiding TCPv4 port %hu', 'Unhiding TCPv6 port %hu', 'Enabling module loading', 'Silently prohibiting module loading') from 'sock.c', and a define statement ('#define SUTERUSU_INIT_WORK') from 'dlexec.c'. The rule triggers if at least three of the function definitions are found, or any of the print strings, or the define statement.