isp.sh Shell Dropper Download and Execution Staging lambsys
This rule detects suspicious activity on Linux endpoints related to the execution of files named 'isp.sh' or 'lambsys', as well as potential file downloads from a known malicious IP address. It monitors process creations and file creations involving these specific artifacts, as well as common attack patterns such as piping web-downloaded content directly to a shell.
SentinelOne
