MYRA Linux RAT LD_PRELOAD and Cron Persistence via Malicious npm Package

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.