3BB: Hidden backdoor file at /usr/local/bin/.rc with execution or network corroborati

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•0

Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.