lambsys/procq Cryptominer Cron Persistence via isp.sh Dropper
Detects persistence mechanisms used by the lambsys/procq cryptominer. It identifies two specific behaviors: 1) Correlation of non-root process execution (isp.sh, lambsys, procq) followed within 120 seconds by modifications to cron configuration files (e.g., /etc/cron.d/, /var/spool/cron/crontabs/) containing suspicious command-line patterns or mining pool references. 2) Direct detection of crontab -e invocations using heredoc redirection (<<) to install persistence payloads that match known miner dropper patterns and mining pool endpoints.
YARA-L
