n4d_persistence_login_hook

rule n4d_persistence_login_hook {
    meta:
        description = "n4d shell login hook"
        author      = "Deception Fleet"
        date        = "2026-07-15"
        hash        = "806381665929b54b2079ed93b464ee660194bb20e294607bdc97ead27e48679e"
    strings:
        $hook = "pgrep -f '/var/tmp/.a|/tmp/.a'"
        $wd   = "/var/tmp/.wd"
    condition:
        filesize < 500 and $hook and $wd
}