[New Rule] Potential Fileless Execution via Unusual memfd Create Call by Aegrah · Pull Request #6748 · elastic/detection-rules

Aegrah · 2026-09-08T10:07:19Z

Summary

This rule comes in favor of a deprecated diagnostic endpoint rule that was too noisy to promote.

elastic-vault-github-plugin-prod · 2026-09-08T10:07:54Z

⛔️ Test failed

Results

❌ Potential Fileless Execution via Unusual memfd Create Call (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

Copilot

🟡 Changes recommended

The new rule’s description is incomplete/misaligned with the new-terms fields and the tags are missing a required tactic tag for the included Execution mapping.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds a new Linux Elastic Defend detection rule intended to replace a deprecated diagnostic endpoint rule by detecting potentially fileless execution activity via unusual memfd_create usage.

Changes:

Introduces a new Linux new_terms rule that alerts on newly observed combinations of host + process lineage when memfd_create activity is seen.
Adds rule metadata, MITRE ATT&CK mappings (Defense Evasion + Execution), and Elastic Defend setup guidance.

File summaries

File	Description
rules/linux/defense_evasion_fileless_execution_via_unusual_memfd_create.toml	New Elastic Defend new_terms rule for detecting potentially fileless execution via unusual `memfd_create` activity.

Review details

Files reviewed: 1/1 changed files
Comments generated: 2
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

elastic-vault-github-plugin-prod · 2026-09-08T12:59:52Z

⛔️ Test failed

Results

❌ Potential Fileless Execution via Unusual memfd Create Call (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-09-08T12:59:56Z

⛔️ Test failed

Results

❌ Potential Fileless Execution via Unusual memfd Create Call (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

bryans3c

Some comments, otherwise LGTM!

bryans3c · 2026-09-09T08:44:38Z

+
+[[rule.new_terms.history_window_start]]
+field = "history_window_start"
+value = "now-10d"


Maybe decrease it to 5d for performance?

#6748 (comment)

bryans3c · 2026-09-09T08:45:53Z

+host.os.type:"linux" and event.category:process and event.type:start and event.action:memfd_create and
+process.executable:(
+  *memfd\:* or /tmp/* or /var/tmp/* or /dev/shm/* or ./* or /run/user/* or /var/run/user/* or
+  /boot/* or /sys/* or /lost+found/* or /proc/* or /var/mail/* or /root/* or *\(deleted\)* or
+  /proc/*/fd/*
+) and process.parent.executable:*


Should we add exclusions for the rule? The deprecated rules contained some exclusions on it

I bumped up the new_terms to 10d to avoid the exclusions; if necessary I will only add common binary FPs. For initial push I think new_terms on 10d should suffice.

Added detailed investigation and response guidelines for detecting potential fileless execution via unusual memfd_create calls in Linux processes.

elastic-vault-github-plugin-prod · 2026-09-11T08:06:59Z

⛔️ Test failed

Results

❌ Potential Fileless Execution via Unusual memfd Create Call (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

elastic-vault-github-plugin-prod · 2026-09-14T11:23:42Z

✅ Test succeeded

Results

elastic-vault-github-plugin-prod · 2026-09-14T11:26:39Z

⛔️ Test failed

Results

❌ Potential Fileless Execution via Unusual memfd Create Call (kuery)
- coverage_issue: no_rta
- stack_validation_failed: no_rta

shashank-elastic

Overall query logic is clean

[New Rule] Potential Fileless Execution via Unusual memfd Create Call

32e9d8e

Aegrah self-assigned this Sep 8, 2026

Aegrah added OS: Linux Rule: New Proposal for new rule Team: TRADE labels Sep 8, 2026

Aegrah marked this pull request as ready for review September 8, 2026 11:48

Copilot AI lite review requested due to automatic review settings September 8, 2026 11:48

github-actions Bot added the backport: auto label Sep 8, 2026

Aegrah requested review from bryans3c, django-88, shashank-elastic and w0rk3r September 8, 2026 11:48

Copilot started reviewing on behalf of Aegrah September 8, 2026 11:49 View session

Copilot AI reviewed Sep 8, 2026

View reviewed changes

Comment thread rules/linux/defense_evasion_fileless_execution_via_unusual_memfd_create.toml

Comment thread rules/linux/defense_evasion_fileless_execution_via_unusual_memfd_create.toml

botelastic Bot added the Domain: Endpoint label Sep 8, 2026

Aegrah and others added 2 commits September 8, 2026 14:59

Clarify detection rule for memfd_create syscall

d20aef5

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Add Execution tactic to defense evasion rule

91da3f2

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

bryans3c approved these changes Sep 9, 2026

View reviewed changes

Enhance memfd_create rule with investigation notes

b38f5ab

Added detailed investigation and response guidelines for detecting potential fileless execution via unusual memfd_create calls in Linux processes.

Add 'Resources: Investigation Guide' to rule

6628e68

Update defense_evasion_fileless_execution_via_unusual_memfd_create.toml

12558be

shashank-elastic approved these changes Sep 15, 2026

View reviewed changes

Aegrah added this pull request to the merge queue Sep 15, 2026

Merged via the queue into main with commit 4315e2b Sep 15, 2026
10 checks passed

Aegrah deleted the new-rule-memfd-create-new-terms branch September 15, 2026 13:10

Uh oh!

Conversation

Aegrah commented Sep 8, 2026

Summary

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bryans3c left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bryans3c Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Aegrah Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

bryans3c Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Aegrah Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shashank-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

elastic-vault-github-plugin-prod Bot commented Sep 8, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Sep 8, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Sep 8, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Sep 11, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Sep 14, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Sep 14, 2026 •

edited

Loading