MYRA RAT Fileless Execution via memfd_create and fexecve
Detects a suspicious execution pattern on Linux systems where 'memfd_create' is used to create an anonymous file in memory, followed by 'fexecve' to execute that memory-resident payload. This pattern is commonly used by fileless malware (such as the Myra RAT) to run code directly from RAM, effectively bypassing disk-based security controls.
Splunk (SPL)
