lambsys Rival Cryptominer Process Termination via pkill targeting xmrig/kinsing/watchdog
Detects the 'lambsys' malware terminating competing cryptocurrency miner processes (such as xmrig, kinsing, or watchdog) using process termination commands (pkill, kill, killall) from a non-root shell. The detection further correlates this activity with the launch of a new miner binary from temporary directories and subsequent outbound network connections to common mining pool ports.
YARA-L
