MYRA RAT Fileless Execution and systemd-userdbd Masquerade via memfd_create

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.