Detection of Fileless Execution via memfd_create on Linux

This brief addresses the risk of fileless execution on Linux systems using the memfd_create system call. The technique allows an attacker to decrypt an ELF payload into an anonymous, memory-backed file, effectively bypassing traditional disk-based security controls. By executing the payload directly from memory - often via /proc/self/fd - malicious actors can execute code without leaving persistent disk artifacts.

Defenders can detect this behavior by monitoring for memfd_create events where the combination of host ID, parent executable, and process executable path has not been previously observed. This approach focuses on behavioral anomalies, helping to distinguish between legitimate system utility usage (such as JIT compilation or software self-updates) and malicious reflective code loading. Because this detection relies on baseline behavioral analysis, organizations should tune these detections against their specific Linux environment to reduce false positives from routine administrative or runtime-specific activity.

Impact

Successful fileless execution enables attackers to maintain stealth, evade host-based security tools, and minimize the footprint of their malicious operations. If used by an adversary, this technique can lead to long-term persistence, credential theft, and unauthorized command execution. Impacts are broad, potentially affecting any enterprise Linux environment, containerized workload, or cloud-native infrastructure that lacks specific behavioral monitoring for process ancestry and memory-backed execution.

Recommendation

• Deploy behavioral monitoring for the memfd_create syscall on all critical Linux endpoints using EDR capabilities.
• Implement the provided detection logic to baseline process lineage and alert on new, unseen combinations of parent/child executables involving memfd-backed execution.
• Establish a process for triaging alerts by reconstructing process ancestry and examining /proc/<pid>/exe mappings before process termination.
• Apply host-based sandboxing, such as systemd unit sandboxing or seccomp profiles, to limit the ability of non-privileged services to execute code from memory-backed or temporary filesystem paths.
• Regularly audit and baseline software that legitimately requires memfd_create functionality (e.g., container runtimes, language JIT compilers) to prevent alert fatigue.