Fileless execution via memfd_create

rule: Fileless execution via memfd_create
desc: 'Detect if a binary is executed from memory using the memfd_create technique.
  This is a well-known defense evasion technique for executing malware on a victim
  machine without storing the payload on disk and to avoid leaving traces about what
  has been executed. Adopters can whitelist processes that may use fileless execution
  for benign purposes by adding items to the list known_memfd_execution_processes.

  '
condition: 'spawned_process and proc.is_exe_from_memfd=true and not known_memfd_execution_processes

  '
output: Fileless execution via memfd_create | container_start_ts=%container.start_ts
  proc_cwd=%proc.cwd evt_res=%evt.res proc_sname=%proc.sname gparent=%proc.aname[2]
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_stable
- host
- container
- process
- mitre_defense_evasion
- T1620