lambsys Cryptominer Defense Evasion: Security Tool Disablement and Dropper Cleanup

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

Detects suspicious command-line activity indicative of an adversary attempting to disable security controls (such as SELinux, AppArmor, UFW, and IPTables) or performing cleanup and maintenance tasks on suspected cryptominer-related files on a Linux system.