MYRA RAT Process Masquerade as systemd-userdbd via prctl PR_SET_NAME
Detects instances of the MYRA RAT process masquerading as the systemd-userdbd daemon. The detection identifies the malicious payload being executed from the /usr/lib/systemd/systemd-userdbd path with command-line arguments typically used by the legitimate system utility, indicating that the Node.js binary has been replaced or copied to evade detection.
YARA-L
