n4d_agent_unpacked

rule n4d_agent_unpacked {
    meta:
        description = "n4d MCP propagation agent (unpacked)"
        author      = "Deception Fleet"
        date        = "2026-07-15"
    strings:
        $h1 = "ExecPy"
        $h2 = "jsCode"
        $h3 = "es_rce"
        $h4 = "pg_rce"
        $m1 = "/mcp"
        $m2 = "/sse"
        $m3 = "jsonrpc"
        $hp1 = "cowrie"
        $hp2 = "t-pot"
        $hp3 = "canary"
        $hp4 = "tarpit"
        $hp5 = "ghidra"
        $go = "Go buildinf:"
    condition:
        uint32(0) == 0x464C457F and
        filesize > 15MB and filesize < 30MB and
        $go and (3 of ($h*)) and (2 of ($hp*)) and (1 of ($m*))
}