lambsys Hidden Directory /var/tmp/.xlamb Creation for Malware Staging

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

This rule detects the creation of directories or files within /var/tmp that use the hidden naming convention (dot-prefix), specifically looking for '.xlamb' or '.x'. Such hidden directories in temporary storage locations are commonly used by attackers for staging malicious tools, malware, or backdoors.