MYRA RAT /proc Filesystem Reconnaissance via process-list and network-enum plugins

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects reconnaissance activities associated with the MYRA RAT, specifically the enumeration of network connections by reading /proc/net/tcp and /proc/net/udp, originating from the systemd-userdbd process. This behavior is indicative of malware attempting to map network state via proc filesystem parsing.