MYRA RAT Profile.d Login Hook Persistence via /etc/profile.d/.sh.local

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•6

Detects the creation of a hidden shell script file at '/etc/profile.d/.sh.local', a common persistence mechanism used by the MYRA RAT. This file is automatically executed by POSIX-compliant shells during the login process to maintain persistence on Linux systems.