lambsys/isp.sh chmod and chattr on miner artifacts in /tmp and /var/tmp

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects suspicious modifications to file permissions and attributes on specific artifacts (lambsys, procq, isp.sh) known to be associated with the Lambsys cryptominer campaign. The rule monitors for execution of chmod or chattr on these artifacts, or any generic chmod activity within /tmp or /var/tmp directories.