lambsys/isp.sh Cryptominer Log and Dropper Deletion Post-Execution

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•3

This rule detects post-execution activity associated with the lambsys/isp.sh cryptominer campaign. It triggers when a known miner binary (lambsys, procq, or isp.sh) is executed, followed within 3 minutes by suspicious cleanup operations including the deletion of log files (wtmp, btmp, system logs), staging directories, or tampering with command history files and shell environment variables.