Detecting Linux Defense Evasion via Executable Self-Deletion

Adversaries targeting Linux environments frequently employ defense evasion techniques to minimize their footprint and complicate incident response. A common behavior observed in both malware and targeted attacks is the execution of a malicious payload from a temporary or ephemeral location, such as /tmp, /dev/shm, or memory-mapped files (memfd), followed by the immediate deletion of the executable file. By removing the file after the process has successfully started, the attacker prevents investigators from easily recovering the binary for static analysis or signature generation. This behavior is a high-fidelity indicator of malicious activity, as legitimate system binaries rarely exhibit this pattern of self-deletion within a short window after execution.

Impact

Successful execution of this technique allows attackers to maintain persistence or conduct malicious operations with a significantly reduced disk signature. This evasion tactic hinders the collection of artifacts needed for root cause analysis and indicator development, potentially allowing an actor to remain undetected for longer periods during an intrusion.

Recommendation

Detection engineering teams should implement monitoring for process-file interaction sequences in ephemeral directories.

• Deploy the provided Sigma rule to identify process execution events followed by file deletion events within a short timeframe.
• Prioritize auditing of temporary directories (/tmp, /var/tmp, /dev/shm) for execution-from-disk activities.
• Enable filesystem monitoring via EDR to capture file deletion events correlated with parent process entity IDs.