MYRA RAT ptrace-based process injection via proc_hide and injector components

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•6

Detects processes exhibiting behaviors indicative of process injection, such as suspicious binary names, command-line arguments related to spawning sleep processes, or ptrace system calls. This rule identifies potential attempts to inject malicious code into other processes to evade defenses or elevate privileges.