lambsys Hidden Staging Directory /var/tmp/.xlamb Creation or Access

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the creation of hidden, dot-prefixed staging directories in /tmp/ or /var/tmp/ commonly associated with the 'lambsys' cryptominer dropper. The rule monitors for the creation of a hidden directory, multiple subsequent file drops (binaries or scripts), execution of chmod +x on these files, and final execution of the binary. A lower-severity alert is triggered when a non-interactive web server process creates such a directory.