Miasma MYRA RAT Linux persistence via LD_PRELOAD and profile.d hijack

Ibrahim Saud@tektrix

•updated Jun 25, 2026•9•0•5

Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.