MYRA Linux RAT LD_PRELOAD Hijack and systemd-userdbd Masquerade
Detects multiple techniques associated with Linux post-exploitation and persistence, including LD_PRELOAD environment variable hijacking, suspicious cron jobs, profile.d persistence modifications, systemd service masquerading via prctl, and fileless execution via memfd_create.
Splunk (SPL)
