{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/fileless-execution/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["linux","defense-evasion","fileless-execution","edr","process-lineage"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis brief addresses the risk of fileless execution on Linux systems using the \u003ccode\u003ememfd_create\u003c/code\u003e system call. The technique allows an attacker to decrypt an ELF payload into an anonymous, memory-backed file, effectively bypassing traditional disk-based security controls. By executing the payload directly from memory - often via \u003ccode\u003e/proc/self/fd\u003c/code\u003e - malicious actors can execute code without leaving persistent disk artifacts.\u003c/p\u003e\n\u003cp\u003eDefenders can detect this behavior by monitoring for \u003ccode\u003ememfd_create\u003c/code\u003e events where the combination of host ID, parent executable, and process executable path has not been previously observed. This approach focuses on behavioral anomalies, helping to distinguish between legitimate system utility usage (such as JIT compilation or software self-updates) and malicious reflective code loading. Because this detection relies on baseline behavioral analysis, organizations should tune these detections against their specific Linux environment to reduce false positives from routine administrative or runtime-specific activity.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful fileless execution enables attackers to maintain stealth, evade host-based security tools, and minimize the footprint of their malicious operations. If used by an adversary, this technique can lead to long-term persistence, credential theft, and unauthorized command execution. Impacts are broad, potentially affecting any enterprise Linux environment, containerized workload, or cloud-native infrastructure that lacks specific behavioral monitoring for process ancestry and memory-backed execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy behavioral monitoring for the \u003ccode\u003ememfd_create\u003c/code\u003e syscall on all critical Linux endpoints using EDR capabilities.\u003c/li\u003e\n\u003cli\u003eImplement the provided detection logic to baseline process lineage and alert on new, unseen combinations of parent/child executables involving memfd-backed execution.\u003c/li\u003e\n\u003cli\u003eEstablish a process for triaging alerts by reconstructing process ancestry and examining \u003ccode\u003e/proc/\u0026lt;pid\u0026gt;/exe\u003c/code\u003e mappings before process termination.\u003c/li\u003e\n\u003cli\u003eApply host-based sandboxing, such as systemd unit sandboxing or seccomp profiles, to limit the ability of non-privileged services to execute code from memory-backed or temporary filesystem paths.\u003c/li\u003e\n\u003cli\u003eRegularly audit and baseline software that legitimately requires \u003ccode\u003ememfd_create\u003c/code\u003e functionality (e.g., container runtimes, language JIT compilers) to prevent alert fatigue.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-15T18:58:26Z","date_published":"2026-09-15T18:58:26Z","id":"https://feed.craftedsignal.io/briefs/2026-09-linux-memfd-detection/","summary":"This brief details a detection strategy for identifying potential fileless execution on Linux platforms by monitoring the memfd_create syscall for anomalous process lineage and execution paths.","title":"Detection of Fileless Execution via memfd_create on Linux","url":"https://feed.craftedsignal.io/briefs/2026-09-linux-memfd-detection/"}],"language":"en","title":"CraftedSignal Threat Feed - Fileless-Execution","version":"https://jsonfeed.org/version/1.1"}