detection rulehost
Hunt for n4d cron persistence
- First seen
- 2026-07-18
- Last seen
- 2026-07-18
- Used in
- 1 post
# Hunt for n4d cron persistence
crontab -l 2>/dev/null | grep -E 'sys-health-monitor|cdnorigin'
find /var/spool/cron /etc/cron.d /etc/crontabs -type f -exec grep -l 'sys-health-monitor\|cdnorigin' {} \; 2>/dev/nullPosts using this rule
Host
The cron-based updater fetches from `cdnorigin.net` or the C2 IP on port 9090.