MYRA RAT memfd_create fileless execution masquerading as systemd-userdbd

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

This rule detects suspicious process execution patterns on Linux systems, specifically looking for processes running from anonymous memory mappings (memfd), execution via /proc/self/fd (fexecve pattern), and processes masquerading as 'systemd-userdbd' from unexpected file paths. These techniques are often used by adversaries for evasion and persistence.