MYRA RAT screen capture via ffmpeg x11grab or grim with MJPEG stream on port 5555

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•2

Detects the execution of known screen capture utilities or commands on Linux systems. This rule looks for processes named 'ffmpeg' or 'grim' and specific command-line arguments often associated with screen recording, such as 'x11grab', 'MJPEG', 'DISPLAY', 'XAUTHORITY', and 'WAYLAND_DISPLAY'. It also flags if the initiating process is 'node', 'systemd-userdbd', or 'npm', which could indicate suspicious activity.