lambsys/isp.sh Cryptominer Cron Persistence on Linux

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

Detects unauthorized cron job creation or modification associated with cryptominer persistence. The rule monitors for common persistence indicators such as referencing 'lambsys', 'isp.sh', or 'procq' within cron-related commands and shell execution patterns that suggest malicious automated tasks in Linux environments.