isp.sh dropper deploying lambsys cryptominer on CVE-2026-33017 Langflow hosts

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

This rule detects potentially malicious activities on Linux systems, including the download of files via curl or wget from a specific IP address, execution of scripts named 'isp.sh', usage of hidden temporary files (e.g., .xlamb), detection of processes named 'lambsys', and execution of scripts within the /var/tmp directory after a chmod +x command. These patterns are often associated with stage-1 or stage-2 dropper behaviors, malware persistence, or post-exploitation activities.