Skynet miner deployed under /tmp/.x then verified running

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•5

Detects a sequence where a process is launched from or references the hidden /tmp/.x directory (indicative of cryptominer deployment), followed within 30 minutes on the same device by a process-check command (such as ps, top, or htop) referencing XMRig or /tmp/.x.