MYRA RAT Fileless Execution via memfd_create Masquerading as systemd-userdbd
Detects fileless execution of the MYRA Linux RAT, which utilizes memfd_create and fexecve to load an ELF binary directly into memory. The detection identifies malicious payloads masquerading as the systemd-userdbd process when spawned by non-standard parent processes such as shell interpreters, node, or npm, as well as abnormal command-line arguments.
Sigma
