CVE-2026-33017 isp.sh Dropper Downloading lambsys Cryptominer on Linux
Detects the execution and download of the 'isp.sh' shell dropper and the 'lambsys' Go-based cryptominer binary on Linux systems. This rule monitors for common dropper patterns, including shell execution of piped commands, use of curl/wget to fetch known malicious components, and instances where Langflow processes attempt to spawn shell-related child processes for potential payload execution.
Sigma
