BYOB C2 dropper/stager shell scripts deploying Meterpreter or miner payloads
Detects malicious bash scripts identified as part of the BYOB C2 framework infrastructure. These scripts are designed to download and install second-stage payloads such as Meterpreter or XMRig-style cryptominers. The rule identifies these scripts by their specific naming conventions, embedded C2 infrastructure indicators, and persistence mechanisms including crontab, systemd, and rc.local.
YARA
