detection rulesuricata
N4D Worm - Agent download from Mesh Control C2
- First seen
- 2026-07-18
- Last seen
- 2026-07-18
- Used in
- 1 post
alert http $HOME_NET any -> 209.99.186.235 any (msg:"N4D Worm - Agent download from Mesh Control C2"; flow:to_server,established; http.uri; content:"/api/agent/"; classtype:trojan-activity; sid:1000637002; rev:2; metadata:created_at 2026_07_10, deployment Egress;)Posts using this rule
Egress · SID 1000637002
Fires on outbound HTTP to the observed C2 IP requesting any agent binary path. Covers both the watchdog re-download and the initial deployment.