alert http $HOME_NET any -> any 3100 (msg:"C2 VoidLink agent binary download (fleet-agent-linux)"; \
flow:to_server,established; \
http.method; content:"GET"; \
http.uri; content:"/downloads/fleet-agent-linux-"; \
classtype:trojan-activity; sid:1000231009; rev:2; \
metadata:created_at 2026-06-07;)Egress · TCP/3100 · SID 1000231009
The agent self-updates by fetching new builds from the C2's distribution endpoint at `/downloads/fleet-agent-linux-{arch}`. Pinned to port 3100 to avoid false positives against legitimate fleet-management tools on standard HTTP ports.