detection rulehost
Hunt for n4d worm persistence artifacts
- First seen
- 2026-07-18
- Last seen
- 2026-07-18
- Used in
- 1 post
# Hunt for n4d worm persistence artifacts
find /dev/shm /tmp /var/tmp -name '.n4d_nid' -o -name '.agent.pid' -o -name '.agent.lock' -o -name '.wd' 2>/dev/null
ls -la /var/tmp/.a /usr/local/lib/.a /tmp/.sys-health-monitor 2>/dev/nullPosts using this rule
Host
The worm's node-ID file and binary self-copies are high-confidence indicators. These paths were confirmed during controlled detonation.