[LINUX-SECURITY] Suspicious Command (> /dev/null)

alert any $HOME_NET any -> $HOME_NET any (msg:"[LINUX-SECURITY] Suspicious Command (> /dev/null)"; content:"> /dev/null & rm"; reference:url,https://blog.apnic.net/2019/10/14/how-to-basic-linux-malware-process-forensics-for-incident-responders/; classtype:trojan-activity; sid:5014632; rev:1; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2024_01_25, updated_at 2024_01_25, mitre_tactic_id TA0007, mitre_technique_id T1087;)