Potential Fileless Execution via Unusual memfd Create Call

Last updated 2 months ago on 2026-09-08

Created 2 months ago on 2026-09-08

About

This rule detects a memfd_create syscall event on Linux where the combination of host and process lineage (parent executable and executable path) has not been seen before. This can indicate fileless execution using memfd-backed executables.

Tags

Domain: EndpointOS: LinuxPlatform: LinuxUse Case: Threat DetectionTactic: Defense EvasionTactic: ExecutionData Source: Elastic DefendRule Type: New TermsLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Reflective Code Loading (T1620)(external, opens in a new tab or window)

↳ Process Injection (T1055)(external, opens in a new tab or window)

Execution (TA0002)(external, opens in a new tab or window)

↳ Native API (T1106)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-endpoint.events.process*
Related Integrations: endpoint(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗host.os.type:"linux" and event.category:process and event.type:start and event.action:memfd_create and
process.executable:(
  *memfd\:* or /tmp/* or /var/tmp/* or /dev/shm/* or ./* or /run/user/* or /var/run/user/* or
  /boot/* or /sys/* or /lost+found/* or /proc/* or /var/mail/* or /root/* or *\(deleted\)* or
  /proc/*/fd/*
) and process.parent.executable:*

Install detection rules in Elastic Security

Detect Potential Fileless Execution via Unusual memfd Create Call in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).