Potential Fileless Execution via O_TMPFILE

  1[metadata]
  2creation_date = "2026/09/07"
  3integration = ["auditd_manager", "crowdstrike", "endpoint", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/07"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule identifies potential fileless ELF execution where a process is launched from an anonymous
 11temporary executable path that appears as "/#<id>" in "process.executable". This pattern may be
 12associated with "O_TMPFILE" and "execveat" with "AT_EMPTY_PATH", which can allow execution without
 13a normal filesystem pathname.
 14"""
 15from = "now-9m"
 16index = [
 17    "auditbeat-*",
 18    "endgame-*",
 19    "logs-crowdstrike.fdr*",
 20    "logs-endpoint.events.process-*",
 21    "logs-sentinel_one_cloud_funnel.*",
 22    "logs-auditd_manager.auditd-*",
 23]
 24language = "eql"
 25license = "Elastic License v2"
 26name = "Potential Fileless Execution via O_TMPFILE"
 27note = """## Triage and analysis
 28
 29> **Disclaimer**:
 30> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 31
 32### Investigating Potential Fileless Execution via O_TMPFILE
 33
 34This rule detects Linux processes launched from anonymous temporary files created with O_TMPFILE, a pattern associated with execveat and AT_EMPTY_PATH execution that leaves no normal filesystem pathname. An attacker can write a malicious ELF payload into an unnamed file descriptor and execute it directly, reducing disk artifacts and making the payload harder to discover through routine file inspection.
 35
 36### Possible investigation steps
 37
 38- Preserve volatile evidence from the live process by collecting its `/proc/<pid>/exe`, file descriptors, memory maps, command line, environment, namespaces, and a hash or copy of the anonymous executable where policy permits.
 39- Reconstruct the full process ancestry and execution context, focusing on the initiating user, parent binary, container or service identity, privilege changes, and whether the chain originated from a shell, web service, or remote session.
 40- Correlate audit telemetry for the preceding `openat` or `openat2` call using `O_TMPFILE`, subsequent writes and permission changes, and the final `execveat` call using `AT_EMPTY_PATH`.
 41- Review nearby network, authentication, and endpoint activity for payload delivery, command-and-control connections, credential access, persistence creation, lateral movement, or additional spawned processes.
 42- Determine prevalence across hosts and compare hashes, ancestry, and execution context with approved software, escalating isolated or unsigned occurrences and containing affected systems when malicious behavior is confirmed.
 43
 44### False positive analysis
 45
 46- Legitimate system or application software may use O_TMPFILE for secure temporary execution, so verify the process ancestry, executable hash, package ownership, and consistency with approved activity.
 47- Authorized software installation, update, or testing workflows may execute an anonymous ELF binary, so confirm the timing against approved changes and validate the initiating user, service, and expected recurrence across comparable hosts.
 48
 49### Response and remediation
 50
 51- Isolate the affected Linux host or container from the network while preserving `/proc/<pid>/exe`, open file descriptors, memory, and relevant audit logs for forensic analysis.
 52- Terminate the malicious process tree, revoke exposed credentials and active sessions, and block identified executable hashes, command-and-control destinations, and payload sources across the environment.
 53- Remove attacker persistence from systemd units, cron jobs, shell profiles, SSH `authorized_keys`, startup scripts, modified containers, and unauthorized accounts or packages.
 54- Escalate immediately to incident response if privileged execution, credential theft, command-and-control traffic, persistence, or activity on additional hosts is identified.
 55- Reimage compromised systems from known-good media, restore validated data, rotate affected secrets, patch the initial access vector, and verify that no anonymous executable or related attacker activity remains.
 56- Harden Linux endpoints by restricting unnecessary O_TMPFILE and `execveat` behavior through application allowlisting, SELinux or AppArmor policies, container controls, and enhanced auditing of anonymous-file execution.
 57"""
 58references = [
 59    "https://github.com/MatheuZSecurity/Dntry",
 60    "https://matheuzsecurity.github.io/hacking/fileless-loader-bypassing-elastic-memfd/",
 61]
 62risk_score = 73
 63rule_id = "6fdd522d-421c-49f5-884e-0f278c388276"
 64setup = """## Setup
 65
 66This rule requires data coming in from Elastic Defend.
 67
 68### Elastic Defend Integration Setup
 69Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 70
 71#### Prerequisite Requirements:
 72- Fleet is required for Elastic Defend.
 73- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 74
 75#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 76- Go to the Kibana home page and click "Add integrations".
 77- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 78- Click "Add Elastic Defend".
 79- Configure the integration name and optionally add a description.
 80- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 81- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 82- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 83- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
 84For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 85- Click "Save and Continue".
 86- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
 87For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 88"""
 89severity = "high"
 90tags = [
 91    "Domain: Endpoint",
 92    "OS: Linux",
 93    "Platform: Linux",
 94    "Use Case: Threat Detection",
 95    "Tactic: Defense Evasion",
 96    "Rule Type: Event Correlation (EQL)",
 97    "Data Source: Auditd Manager",
 98    "Data Source: Elastic Defend",
 99    "Data Source: Elastic Endgame",
100    "Data Source: Crowdstrike",
101    "Data Source: SentinelOne",
102    "Resources: Investigation Guide",
103]
104timestamp_override = "event.ingested"
105type = "eql"
106query = '''
107process where host.os.type == "linux" and event.type == "start" and
108event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
109process.executable regex """.*/\#[0-9]+.*"""
110'''
111
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114
115[[rule.threat.technique]]
116id = "T1036"
117name = "Masquerading"
118reference = "https://attack.mitre.org/techniques/T1036/"
119
120[[rule.threat.technique.subtechnique]]
121id = "T1036.005"
122name = "Match Legitimate Resource Name or Location"
123reference = "https://attack.mitre.org/techniques/T1036/005/"
124
125[rule.threat.tactic]
126id = "TA0005"
127name = "Defense Evasion"
128reference = "https://attack.mitre.org/tactics/TA0005/"