n4d_persistence_updater

rule n4d_persistence_updater {
    meta:
        description = "n4d cron updater script"
        author      = "Deception Fleet"
        date        = "2026-07-15"
        hash        = "001a23e4a0c7cbdc076db370cfcffbbbd7c86214040f339708ca9b818fba69ab"
    strings:
        $lock = "/tmp/.n4d_lock"
        $cdn = "cdnorigin.net"
        $agent_path = "/api/agent/binary?arch="
    condition:
        filesize < 2KB and $lock and $cdn and $agent_path
}