lambsys/isp.sh cryptominer dropper deletion and chmod evasion on Linux

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects the execution of potentially suspicious cleanup and maintenance commands (e.g., clearing history, changing permissions, removing files) on Linux systems that are often associated with post-exploitation activity or evidence removal. The rule monitors for these patterns specifically when initiated by commands involving common suspicious file paths like 'isp.sh', 'lambsys', or '/var/tmp/.xlamb'.