MYRA RAT Process Masquerade via systemd-userdbd Impersonation
Detects MYRA RAT's proc_hide and agent_launcher components masquerading as systemd-userdbd by copying Node.js binary to /usr/lib/systemd/systemd-userdbd and using prctl PR_SET_NAME to overwrite process name and argv[0]. This rule identifies suspicious process activity where a process attempts to impersonate 'systemd-userdbd' by having a matching folder path or command line, but originating from an unexpected location or being associated with known MYRA RAT components like 'agent_launcher' or 'proc_hide', or Node.js.
Microsoft Sentinel (KQL)
