Linux Detection Engineering - Fileless Execution
ID: 51c37d2b-eef4-5898-bb39-be0904680e8e
STIX ID: report--51c37d2b-eef4-5898-bb39-be0904680e8e
Feed Name: Elastic Security Labs
Threat Score
This research article documents how Linux fileless execution has moved from niche techniques to real-world intrusion chains, describing memfd_create anonymous execution, interpreter-backed and staged execution, deleted-file execution, and fileless loadable kernel module loading. It reproduces PoCs using the FENIX lab framework and maps observable behaviors to Elastic Defend telemetry (memfd_create, exec via /proc/self/fd, init_module/finit_module) to support detection and hunting.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.