MYRA RAT LD_PRELOAD Persistence via libcache.so and /etc/profile.d/.sh.local
Detects evidence of the MYRA Linux RAT attempting to establish persistence via the LD_PRELOAD environment variable mechanism. The rule monitors for the creation or modification of specific malicious library files (libcache.so, .sh.local) and the execution of processes utilizing LD_PRELOAD to hijack dynamic linker operations.
Splunk (SPL)
