From ea11e8e2805231fd4c986072000f9289ce605808 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud Date: Mon, 7 Sep 2026 15:22:57 +0200 Subject: [PATCH 1/8] [New Rule] Potential Fileless Execution via O_TMPFILE --- ...ion_fileless_execution_via_o_tempfile.toml | 95 +++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml new file mode 100644 index 00000000000..d12b0f80066 --- /dev/null +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -0,0 +1,95 @@ +[metadata] +creation_date = "2026/09/07" +integration = ["auditd_manager", "crowdstrike", "endpoint", "sentinel_one_cloud_funnel"] +maturity = "production" +updated_date = "2026/09/07" + +[rule] +author = ["Elastic"] +description = """ +This rule identifies fileless ELF execution via anonymous temporary files created with +O_TMPFILE and executed using execveat with AT_EMPTY_PATH. This technique can be used to +execute a malicious ELF file without leaving a trace on the filesystem. +""" +from = "now-9m" +index = [ + "auditbeat-*", + "endgame-*", + "logs-crowdstrike.fdr*", + "logs-endpoint.events.process*", + "logs-sentinel_one_cloud_funnel.*", + "logs-auditd_manager.auditd-*", +] +language = "eql" +license = "Elastic License v2" +name = "Potential Fileless Execution via O_TMPFILE" +references = [ + "https://github.com/MatheuZSecurity/Dntry" +] +risk_score = 73 +rule_id = "80c05dcd-5010-4ca9-af35-7a40c09d2504" +setup = """## Setup + +This rule requires data coming in from Elastic Defend. + +### Elastic Defend Integration Setup +Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app. + +#### Prerequisite Requirements: +- Fleet is required for Elastic Defend. +- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html). + +#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System: +- Go to the Kibana home page and click "Add integrations". +- In the query bar, search for "Elastic Defend" and select the integration to see more details about it. +- Click "Add Elastic Defend". +- Configure the integration name and optionally add a description. +- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads". +- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html). +- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions" +- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. +For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html). +- Click "Save and Continue". +- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. +For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html). +""" +severity = "high" +tags = [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Auditd Manager", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame", + "Data Source: Crowdstrike", + "Data Source: SentinelOne", + "Resources: Investigation Guide", +] +timestamp_override = "event.ingested" +type = "eql" +query = ''' +process where host.os.type == "linux" and event.type == "start" and +event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and +process.executable regex """.*/\#[0-9]+.*""" +''' +note = """ +""" + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[[rule.threat.technique.subtechnique]] +id = "T1036.005" +name = "Match Legitimate Resource Name or Location" +reference = "https://attack.mitre.org/techniques/T1036/005/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" From 285d78a4ca9d7be883dfd69c0844d6c29b4e7594 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud Date: Mon, 7 Sep 2026 15:23:24 +0200 Subject: [PATCH 2/8] ++ --- .../defense_evasion_fileless_execution_via_o_tempfile.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml index d12b0f80066..f0ba073653e 100644 --- a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -27,7 +27,7 @@ references = [ "https://github.com/MatheuZSecurity/Dntry" ] risk_score = 73 -rule_id = "80c05dcd-5010-4ca9-af35-7a40c09d2504" +rule_id = "6fdd522d-421c-49f5-884e-0f278c388276" setup = """## Setup This rule requires data coming in from Elastic Defend. From ff96ed8bd5e7fde460f5bfd71132540465af890a Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud Date: Mon, 7 Sep 2026 15:27:26 +0200 Subject: [PATCH 3/8] ++ --- ...ion_fileless_execution_via_o_tempfile.toml | 33 +++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml index f0ba073653e..54fd74ea042 100644 --- a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -23,6 +23,37 @@ index = [ language = "eql" license = "Elastic License v2" name = "Potential Fileless Execution via O_TMPFILE" +note = """## Triage and analysis + +> **Disclaimer**: +> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs. + +### Investigating Potential Fileless Execution via O_TMPFILE + +This rule detects Linux processes launched from anonymous temporary files created with O_TMPFILE, a pattern associated with execveat and AT_EMPTY_PATH execution that leaves no normal filesystem pathname. An attacker can write a malicious ELF payload into an unnamed file descriptor and execute it directly, reducing disk artifacts and making the payload harder to discover through routine file inspection. + +### Possible investigation steps + +- Preserve volatile evidence from the live process by collecting its `/proc//exe`, file descriptors, memory maps, command line, environment, namespaces, and a hash or copy of the anonymous executable where policy permits. +- Reconstruct the full process ancestry and execution context, focusing on the initiating user, parent binary, container or service identity, privilege changes, and whether the chain originated from a shell, web service, or remote session. +- Correlate audit telemetry for the preceding `openat` or `openat2` call using `O_TMPFILE`, subsequent writes and permission changes, and the final `execveat` call using `AT_EMPTY_PATH`. +- Review nearby network, authentication, and endpoint activity for payload delivery, command-and-control connections, credential access, persistence creation, lateral movement, or additional spawned processes. +- Determine prevalence across hosts and compare hashes, ancestry, and execution context with approved software, escalating isolated or unsigned occurrences and containing affected systems when malicious behavior is confirmed. + +### False positive analysis + +- Legitimate system or application software may use O_TMPFILE for secure temporary execution, so verify the process ancestry, executable hash, package ownership, and consistency with approved activity. +- Authorized software installation, update, or testing workflows may execute an anonymous ELF binary, so confirm the timing against approved changes and validate the initiating user, service, and expected recurrence across comparable hosts. + +### Response and remediation + +- Isolate the affected Linux host or container from the network while preserving `/proc//exe`, open file descriptors, memory, and relevant audit logs for forensic analysis. +- Terminate the malicious process tree, revoke exposed credentials and active sessions, and block identified executable hashes, command-and-control destinations, and payload sources across the environment. +- Remove attacker persistence from systemd units, cron jobs, shell profiles, SSH `authorized_keys`, startup scripts, modified containers, and unauthorized accounts or packages. +- Escalate immediately to incident response if privileged execution, credential theft, command-and-control traffic, persistence, or activity on additional hosts is identified. +- Reimage compromised systems from known-good media, restore validated data, rotate affected secrets, patch the initial access vector, and verify that no anonymous executable or related attacker activity remains. +- Harden Linux endpoints by restricting unnecessary O_TMPFILE and `execveat` behavior through application allowlisting, SELinux or AppArmor policies, container controls, and enhanced auditing of anonymous-file execution. +""" references = [ "https://github.com/MatheuZSecurity/Dntry" ] @@ -73,8 +104,6 @@ process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and process.executable regex """.*/\#[0-9]+.*""" ''' -note = """ -""" [[rule.threat]] framework = "MITRE ATT&CK" From 96046f388817e7ea7f557ffaa9aef3302e93c14f Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 7 Sep 2026 17:04:55 +0200 Subject: [PATCH 4/8] Fix pattern for logs-endpoint.events.process Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../defense_evasion_fileless_execution_via_o_tempfile.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml index 54fd74ea042..cd5af046d65 100644 --- a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -16,7 +16,7 @@ index = [ "auditbeat-*", "endgame-*", "logs-crowdstrike.fdr*", - "logs-endpoint.events.process*", + "logs-endpoint.events.process-*", "logs-sentinel_one_cloud_funnel.*", "logs-auditd_manager.auditd-*", ] From dd6bf1b73a7699e3b7dc26e8e7533cb1ce0d1276 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 7 Sep 2026 17:05:25 +0200 Subject: [PATCH 5/8] Clarify rule for fileless ELF execution detection Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../defense_evasion_fileless_execution_via_o_tempfile.toml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml index cd5af046d65..f0bc851b410 100644 --- a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -7,9 +7,8 @@ updated_date = "2026/09/07" [rule] author = ["Elastic"] description = """ -This rule identifies fileless ELF execution via anonymous temporary files created with -O_TMPFILE and executed using execveat with AT_EMPTY_PATH. This technique can be used to -execute a malicious ELF file without leaving a trace on the filesystem. +This rule identifies potential fileless ELF execution where a process is launched from an anonymous temporary executable path that appears as `/#` in `process.executable`. +This pattern is often associated with `O_TMPFILE` and `execveat` with `AT_EMPTY_PATH`, which can allow execution without a normal filesystem pathname. """ from = "now-9m" index = [ From 56c601ec8a4dd7bb392c2a73c8594fd51aa2e8e2 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 7 Sep 2026 17:05:38 +0200 Subject: [PATCH 6/8] Modify defense evasion rule for fileless execution Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../defense_evasion_fileless_execution_via_o_tempfile.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml index f0bc851b410..0232577c4b6 100644 --- a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -54,7 +54,8 @@ This rule detects Linux processes launched from anonymous temporary files create - Harden Linux endpoints by restricting unnecessary O_TMPFILE and `execveat` behavior through application allowlisting, SELinux or AppArmor policies, container controls, and enhanced auditing of anonymous-file execution. """ references = [ - "https://github.com/MatheuZSecurity/Dntry" + "https://github.com/MatheuZSecurity/Dntry", + "https://matheuzsecurity.github.io/hacking/fileless-loader-bypassing-elastic-memfd/", ] risk_score = 73 rule_id = "6fdd522d-421c-49f5-884e-0f278c388276" From 0ea934f5c3d6c1d1dca0e5bde2ec674507dd3e24 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 7 Sep 2026 17:05:47 +0200 Subject: [PATCH 7/8] Add platform and rule type tags to TOML file Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../defense_evasion_fileless_execution_via_o_tempfile.toml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml index 0232577c4b6..f0d6d5b4a83 100644 --- a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -88,8 +88,10 @@ severity = "high" tags = [ "Domain: Endpoint", "OS: Linux", + "Platform: Linux", "Use Case: Threat Detection", "Tactic: Defense Evasion", + "Rule Type: Event Correlation (EQL)", "Data Source: Auditd Manager", "Data Source: Elastic Defend", "Data Source: Elastic Endgame", From 634bc218c9949e7bad36c42798830ce44b3e3081 Mon Sep 17 00:00:00 2001 From: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com> Date: Mon, 7 Sep 2026 17:06:43 +0200 Subject: [PATCH 8/8] Refine rule description for fileless ELF execution Updated the description formatting for clarity. --- .../defense_evasion_fileless_execution_via_o_tempfile.toml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml index f0d6d5b4a83..866f374172c 100644 --- a/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml +++ b/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml @@ -7,8 +7,10 @@ updated_date = "2026/09/07" [rule] author = ["Elastic"] description = """ -This rule identifies potential fileless ELF execution where a process is launched from an anonymous temporary executable path that appears as `/#` in `process.executable`. -This pattern is often associated with `O_TMPFILE` and `execveat` with `AT_EMPTY_PATH`, which can allow execution without a normal filesystem pathname. +This rule identifies potential fileless ELF execution where a process is launched from an anonymous +temporary executable path that appears as "/#" in "process.executable". This pattern may be +associated with "O_TMPFILE" and "execveat" with "AT_EMPTY_PATH", which can allow execution without +a normal filesystem pathname. """ from = "now-9m" index = [