lambsys Cryptominer Security Tool Tampering and Firewall Modification

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

This rule detects attempts to disable, stop, or tamper with security-critical Linux system services and configurations. This includes stopping AppArmor, disabling firewalls (iptables, nftables, ufw), disabling SELinux, and modifying file attributes with 'chattr' to potentially hinder security monitoring or unauthorized file modifications.