MYRA RAT memfd_create + fexecve Fileless Execution via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects in-memory execution of the MYRA RAT originating from a node.exe process. The rule monitors for suspicious process creation patterns associated with fileless techniques, including execution from memory file descriptors (memfd), /proc/self/fd, or empty process image paths, as well as unauthorized process interaction with systemd-userdbd, indicative of node.js supply chain compromises.