MYRA RAT PTY Reverse Shell to RFC-1918 C2 Address
Detects the creation of an interactive shell (e.g., bash -i, Python pty, socat) on a Linux host that simultaneously initiates an outbound network connection to an RFC-1918 private IP address. This pattern is characteristic of attackers using reverse shells for command and control or internal network reconnaissance, specifically matching behaviors associated with the MYRA RAT shell-pty plugin.
YARA-L
