lambsys Cryptominer Geolocation and Host Fingerprinting via curl/wget to ipinfo.io
Detects host fingerprinting and geolocation activity performed by the Lambsys/procq cryptominer. The rule identifies processes like curl or wget querying external IP intelligence services (ipinfo.io, ip-api.com) when associated with suspicious binary paths or spawned by known miner processes.
Sigma
