MYRA RAT Process Masquerading as systemd-userdbd via prctl PR_SET_NAME
Detects processes using prctl with PR_SET_NAME to rename themselves to systemd-userdbd, a technique used by the MYRA RAT (Operation Friday Harvest) to masquerade as a legitimate system daemon and evade process-tree inspection. The rule looks for processes with 'systemd-userdbd' in their product name or in specific suspicious folders, or processes named 'systemd-userdbd' initiated by 'node' or 'npm'. It also identifies process name changes or modifications to process primary tokens that include 'systemd-userdbd'.
Microsoft Sentinel (KQL)
