MYRA RAT ptrace Process Injection via injector with sleep 600 Spawn
Detects the execution of an injector process associated with MYRA RAT, specifically monitoring for ptrace-based process injection techniques. The rule identifies processes attempting to attach to other processes using system calls like PTRACE_ATTACH, PTRACE_PEEKDATA, PTRACE_POKEDATA, or process_vm_writev. It also flags the specific behavior of spawning a 'sleep 600' decoy process as an injection target.
YARA-L
