MYRA RAT Fileless Execution via memfd_create and fexecve

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the execution of processes where the image path or parent process path originates from anonymous memory file descriptors ('/memfd:') or file descriptor links ('/proc/self/fd/'). These patterns are frequently associated with fileless malware execution where binaries are executed directly from memory to avoid disk-based detection.