RedTail clean.sh execution disabling c3pool_miner and killing artifacts

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•0

This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.