rule Cling_IoT_Botnet_Artifacts {
    meta:
        author = "Tia N. List"
        date = "2026-10-01"
        status = "experimental"
        description = "Cling MIPS/Linux IoT botnet artifacts: the realtek.selfrep infection tag, hidden .cling binaries dropped under /root and /usr/local/bin, and the wget.p/wget.r wrapper files used to hijack wget during propagation. Derived from case analysis (Nozomi Networks) — NOT validated against a live sample."
        reference = "https://www.nozominetworks.com/blog/a-stunning-disguise-cling-malware-masquerades-as-google-"
        falsepositives = "Custom firmware or admin tooling that legitimately references these paths; combine with STUN beaconing (all-zero transaction IDs every five seconds) before acting"
    strings:
        $tag = "realtek.selfrep" ascii nocase
        $path1 = "/root/.cling" ascii
        $path2 = "/usr/local/bin/.cling" ascii
        $wget_p = "wget.p" ascii
        $wget_r = "wget.r" ascii
    condition:
        uint32(0) == 0x464C457F and (any of ($path*) or ($tag and any of ($wget*)))
}