detection rulehost
Hunt for n4d login-hook persistence
- First seen
- 2026-07-18
- Last seen
- 2026-07-18
- Used in
- 1 post
# Hunt for n4d login-hook persistence
grep -l 'pgrep.*var/tmp/\.a\|/var/tmp/\.wd' /etc/profile.d/.sys_alias.sh /root/.bashrc 2>/dev/nullPosts using this rule
Host
The login-hook content confirmed from detonation artifacts. Searches for the exact persistence pattern in shell profiles.