/boot/config/plugins/user.scripts/scripts/setting/script
Does anyone know if this user.scripts is normal? Is it part of the plugin, or has it been modified by someone?
Here’s the situation: I discovered a mining program running on my Unraid, and upon checking the logs, I found that someone had logged into my Unraid and modified the SSH keys. Finally, I found a script in user.scripts that downloads xmrig. What I want to know is the sequence of events: did someone log into my Unraid and modify my user.scripts script to download xmrig, or does the user.scripts plugin come with a script to download xmrig, and then someone logged into my Unraid?