detection rulesuricata
N4D Worm - Agent download from cdnorigin.net
- First seen
- 2026-07-18
- Last seen
- 2026-07-18
- Used in
- 1 post
alert http $HOME_NET any -> any any (msg:"N4D Worm - Agent download from cdnorigin.net"; flow:to_server,established; http.host; content:"cdnorigin.net"; http.uri; content:"/api/agent/"; classtype:trojan-activity; sid:1000637003; rev:2; metadata:created_at 2026_07_10, deployment Egress;)Posts using this rule
Egress · SID 1000637003
Fires on outbound HTTP to the update distribution domain requesting the agent binary.