detection ruleyara
n4d_ssh_key
- First seen
- 2026-07-18
- Last seen
- 2026-07-18
- Used in
- 1 post
rule n4d_ssh_key {
meta:
description = "n4d SSH persistence key"
author = "Deception Fleet"
date = "2026-07-15"
strings:
$key = "AAAAC3NzaC1lZDI1NTE5AAAAIJKH4g/SD6c00i5PzlWWkwXJwIHEac+nlAjg6WeOHUq3"
condition:
$key
}Posts using this rule
File scan (YARA) · SID n4d_ssh_key
Definitive indicator in any `authorized_keys` file. Confirmed in both Docker delivery and dynamic analysis.