MYRA Linux RAT: LD_PRELOAD Rootkit, memfd Fileless Exec, and cron/profile Persistence

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•6

This rule detects various Linux persistence mechanisms, including the use of LD_PRELOAD to hijack dynamic linker execution, the creation or modification of malicious cron jobs, and tampering with shell startup scripts. These techniques allow an adversary to maintain access to a compromised host by ensuring malicious code is executed automatically or injected into legitimate processes.