MYRA RAT Fileless Execution via memfd_create and systemd-userdbd Masquerade

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects instances where a Node.js process spawns or executes the systemd-userdbd utility. systemd-userdbd is a system daemon used for user/group database lookups. Execution of this component by a user-land Node.js application is highly atypical and may indicate a compromise where an attacker is abusing system binaries for persistence, privilege escalation, or reconnaissance.