MYRA RAT Live Screen Capture via ffmpeg x11grab or grim Serving MJPEG on Port 5555
Detects the use of screen capture utilities such as ffmpeg, grim, scrot, or xwd, which are often used by the MYRA RAT to capture live desktop sessions for exfiltration.
YARA-L
