Process executed from an anonymous in-memory file on Linux

Siemphony@siemphonymediumT1620unverified

AN0839 asks for mmap + mprotect turning writable memory executable inside one process with no ELF on disk behind it. The permission-change half is not reachable here: the analytic's only source for it is the raw `auditd:MMAP` feed, which the brief gives no field names for, and lib/sigma has no way to join two syscalls in one process anyway. What is reachable is the end of that chain that does create an event — an `execve` whose executable is an anonymous file rather than a path on a filesystem. A payload placed with `memfd_create` and executed with `fexecve` has no directory entry at all, so the kernel reports its path as `/memfd:<label> (deleted)`, and that `memfd:` marker is the whole selection. MITRE's `ProcessNameScope` knob is what this implements — the knob's own text says it is uncommon for service binaries to call `memfd_create` — though scoping it to a named set of high-risk processes is left to the deployer rather than baked in, because on a clean host the unscoped form is already rare. One exclusion is applied: `runc` defends against CVE-2019-5736 by copying its own binary into a memfd and re-executing it, labelling the clone `runc_cloned:/proc/self/exe`, so on any container host that self-copy would otherwise be nearly every match. The exclusion matches runc's full label rather than a fragment of it, but the label of a memfd is chosen by whoever creates it, so an adversary who names theirs the same string is excluded too — treat the filter as noise suppression, not as a boundary that holds under contact. MITRE's `RWXMemoryThreshold` knob (allow some RWX allocations before alerting, for JIT runtimes) is not applied at all: it is a count over a window, and Sigma models neither. Scope and limits. This is the fileless *execution* case only. Reflective loading into a process that is already running — `Assembly.Load()` in a live PowerShell session, shellcode written into a JIT'd region, a dlopen from a memory buffer — creates no new process and therefore no event this rule can see, and that is the larger half of the technique. The Windows arm AN0838 is not attempted: it describes a VirtualAlloc/VirtualProtect/CreateThread sequence inside a single PID, and none of its three sources record it — Sysmon EventID 1 is process creation, EventID 7 fires only for modules that *have* a backing file, and EventID 10 is cross-process access, which reflective loading by definition does not perform. The macOS arm AN0840 offers only `macos:unifiedlog`, which has no standardised Sigma field vocabulary, so its fields would have to be invented. Vocabulary and prerequisite: this rule is written in the Sysmon-for-Linux-shaped `process_creation` vocabulary (`Image`) that the brief maps `auditd:SYSCALL::execve` onto; raw auditd carries the same value as `exe=` on a SYSCALL record and needs that field mapping first, and it records no execve at all until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded. Until one is, this rule returns zero rows, and zero rows here means blind rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0300, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath contains "memfd:" and not (FolderPath contains "runc_cloned:/proc/self/exe"))

Splunk · SPL

Run this as a search.

index=* (Image="*memfd:*" AND NOT (Image="*runc_cloned:/proc/self/exe*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*memfd:*" AND NOT (TO_LOWER(process.executable) LIKE "*runc_cloned:/proc/self/exe*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)memfd:</field>    <field name="Image" negate="yes" type="pcre2">(?i)runc_cloned:/proc/self/exe</field>    <description>Process executed from an anonymous in-memory file on Linux</description>    <mitre>      <id>T1620</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a3d63a84-c6b4-4f5a-a70b-8cd0f8d22e99

ATT&CKT1620

T1620Reflective Code Loading

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

The Linux arm of reflective code loading, and only half of it. AN0839 asks for mmap followed by mprotect turning writable memory executable inside one process. Sigma cannot join two syscalls in one PID, and the brief names no fields for the raw auditd:MMAP feed, so that half is unreachable. What the rule catches is the tail of the chain that does emit an event: an execve whose executable is an anonymous in-memory file, created with memfd_create and run with fexecve. Such a file has no directory entry, so the kernel reports its path as /memfd:<label> (deleted). Loading into a process that is already running — Assembly.Load() in a live session, shellcode written into a JIT region, a dlopen from a buffer — creates no new process and produces nothing this rule can see. That is the larger half of the technique.

02 · Telemetry you need

process_creation / linux, the Sysmon-for-Linux-shaped vocabulary the brief maps auditd:SYSCALL::execve onto. auditd records no execve until a rule such as -a always,exit -F arch=b64 -S execve -k exec is loaded; until then this returns zero rows, and zero rows here means blind, not quiet. Raw auditd carries the same value as exe= and needs mapping to Image first. The rule depends on Image being resolved after exec, as exe= is. An agent that populates Image from the execve filename argument sees /proc/self/fd/3 or an empty string instead — check yours before reading silence as absence.

03 · How the logic works

Two blocks. selection_memfd_exec is a single term, Image|contains: 'memfd:'; that marker is the whole detection. filter_runc_self_clone subtracts Image|contains: 'runc_cloned:/proc/self/exe', because runc mitigates CVE-2019-5736 by copying its own binary into a memfd and re-executing it, which on a container host would otherwise be nearly every match. The condition is selection and not filter. The filter deliberately matches runc's full label rather than the fragment runc_cloned: a memfd label is the first argument to memfd_create and is chosen by whoever creates it, so a short substring exclusion is a one-token bypass sitting inside the rule's only negation. Even the full-string form is noise suppression, not a boundary — an adversary who names their memfd identically is dropped too. MITRE's ProcessNameScope knob is what the selection implements, and its own text notes it is uncommon for service binaries to call memfd_create; narrowing to a named set of high-risk processes is left to the deployer. MITRE's RWXMemoryThreshold knob — tolerate some RWX allocations before alerting, for JIT runtimes — is not applied at all, being a count over a window that Sigma does not model.

04 · Common false positives

Container runtimes other than stock runc: forks, vendored rebuilds and other OCI runtimes performing the same CVE mitigation under labels of their own, one match per container start. On a Kubernetes worker that is the highest-volume source by a wide margin. Red-team ranges, detonation sandboxes and analyst workstations produce matches identical in the log to a real intrusion. Administrators working around noexec mounts by running a static troubleshooting binary from an anonymous file, and vendor agents that self-update the same way.

05 · Detection maturity

tier_1: Lowest tier. This rule is machine-derived from MITRE ATT&CK v19.2 and has never been executed against a log line: no true positive, no false positive, no measured volume. The level and the noise ranking above are reasoning, not measurement. It rises only once you run it over historical data, confirm the field really carries memfd: in your pipeline, and detonate a memfd execution in a lab to watch it fire.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline first, then extend the filter with the full labels your own runtimes use — never a fragment. The medium level assumes a host that is not a container worker; on a container fleet drop to low until runtime noise is characterised, and raise it on hosts where memfd exec should never occur. If your agent uses pre-exec filename semantics, adding /proc/self/fd/ as a second alternative is the fix, but it carries a different noise profile — verify against the deployed agent rather than adding it blind.

Declared by the author

Container runtimes whose self-clone is not the excluded string. The filter removes runc's own label, but forks and vendored rebuilds of runc, and other OCI runtimes that copy their binary into an anonymous file for the same CVE-2019-5736 mitigation, use labels of their own and still match once per container start. On a busy Kubernetes worker node that remains the highest-volume source here by a wide margin, which is why this rule is medium rather than high.
Authorised offensive testing and malware analysis. In-memory stagers and shellcode loaders are built to execute exactly this way, so on a red-team range, a detonation sandbox or an analyst workstation every sample and every exercise produces a match that is identical in the log to a real intrusion, distinguishable only by the host it came from.
Administrative work on hosts where the writable filesystems are mounted noexec. Writing a statically linked troubleshooting tool into an anonymous file and running it from there is a documented way to work around that restriction on appliances and hardened builds, and some vendor support scripts and self-updating agents fetch and run their helper the same way rather than dropping it on disk.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1620, evaluated against their process_creation events.

Share this rule

/u/siemphony/a3d63a84-c6b4-4f5a-a70b-8cd0f8d22e99

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@tomas-eriksen
22 Aug 2026
On our Kubernetes workers the runc exclusion is doing enormous work — without it you get roughly one match per container start, which is tens of thousands a day on a busy node. Worth flagging for anyone on a mixed runtime estate: the exclusion matches runc's own label, and Kata and gVisor clone differently, so they come straight back. The sentence about a memfd label being chosen by whoever creates it is the most important line in the rule.
- @priya-raman
  22 Aug 2026
  Confirmed on our range: name your memfd `runc_cloned:/proc/self/exe` and the stager walks past the filter untouched. It is noise suppression, exactly as the description labels it, and I wish more rules were this honest about which of their filters hold under contact. We keep an unfiltered copy scoped to hosts that are not container nodes, where the label has no legitimate reason to appear.

Process executed from an anonymous in-memory file on Linux

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it

1 thread