lambsys cryptominer security tool disablement and log deletion post-deployment

Ibrahim Saud@tektrix

•updated Jun 26, 2026•2•0•5

Detects coordinated security defense evasion activities by the Lambsys cryptominer campaign. The rule triggers when a shell process (bash, sh, or dash) is used to stop or disable security services (auditd, ClamAV, osquery, Falco, CrowdStrike Falcon), forcibly terminate their processes using pkill or kill -9, and delete or shred critical system security and audit logs (auth.log, syslog, audit).