MYRA RAT node-pty PTY shell C2 over TCP port 4444

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•2

This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.