lambsys cryptominer cron persistence via /var/tmp/.xlamb and init_rmount

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•3

This rule detects the execution of specific shell processes (sh, bash, crontab) where command-line arguments reference suspicious paths commonly associated with persistence mechanisms or malware, such as /var/tmp/ files or crontab spool directories.