lambsys cryptominer crontab persistence via web app accounts or suspicious paths
Detects potential persistence attempts via cron job manipulation by unprivileged service accounts (such as www-data) or patterns indicative of the 'lambsys' threat, including usage of known writable temporary directories, non-interactive crontab installations, and aggressive execution schedules.
Microsoft Sentinel (KQL)
