lambsys SSH Key Harvesting for Lateral Movement via isp.sh

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects reconnaissance and credential harvesting activities associated with the Lambsys cryptominer campaign. The rule monitors for unauthorized enumeration of SSH directories, key files, and the use of SSH utilities for lateral movement, specifically triggered by the presence of 'isp.sh' or 'lambsys' in command arguments or related patterns.