MYRA RAT Masquerading as systemd-userdbd via prctl Process Rename
Detects the MYRA RAT using the prctl system call to rename its process to 'systemd-userdbd'. This masquerading technique aims to evade detection by blending in with legitimate system processes on Linux endpoints. The rule monitors process execution events for instances of 'systemd-userdbd' that do not originate from authorized system directories.
Microsoft Sentinel (KQL)
