MYRA RAT Fileless Execution via memfd_create and fexecve

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects execution patterns associated with fileless techniques on Linux systems, specifically looking for the usage of the memfd_create system call or referencing /proc/self/fd/ to execute code directly from memory. These methods are frequently used by adversaries to load and run malicious payloads without writing files to disk, bypassing traditional file-based antivirus scanners.