n4d_persistence_watchdog

rule n4d_persistence_watchdog {
    meta:
        description = "n4d watchdog script"
        author      = "Deception Fleet"
        date        = "2026-07-15"
        hash        = "dfe3ff4f58fbc1784858840858bb02fd88a9a003476c24a97e7604b9b9cb3fea"
    strings:
        $pgrep = "pgrep -f '/var/tmp/.a|/tmp/.a|/dev/shm/.a'"
        $c2_dl = "/api/agent/full?arch="
        $sleep = "sleep 25"
    condition:
        filesize < 2KB and $pgrep and $c2_dl and $sleep
}