MYRA RAT Fileless Execution: memfd_create/fexecve via systemd-userdbd Masquerade

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potentially malicious activity on Linux systems by monitoring for two suspicious patterns: 1) The 'systemd-userdbd' process being spawned by Node.js or npm, which may indicate a supply-chain attack where a package masquerades as a system daemon, and 2) The execution of processes from anonymous file descriptors within '/proc/self/fd/', a common indicator of fileless execution techniques (e.g., fexecve).