dsatp/rules.yar

rule IoTMalware {
    strings:
        $mirai = "mirai" nocase
        $botnet = "botnet" nocase
        $exploit = "exploit" nocase
    condition:
        any of them
}