TLDR Tech / InfoSec
Fileless ELF Execution via O_TMPFILE
A red-team loader chains O_TMPFILE with execveat(AT_EMPTY_PATH) to run an ELF that never gets a directory entry, allocating a real inode on /tmp with no dentry so ls, find, inotify, and fanotify never see it, then reopening the fd read-only through /proc/self/fd/ to clear ETXTBSY and executing it directly with no path string ever constructed. The technique sidesteps fileless detection built for memfd_create because it produces none of the expected artifacts: no memfd: prefix, no 00:01 device, no syscall 319, and the only residual signal is the (deleted) suffix that countless legitimate open-unlink-exec programs also generate. Defenders should stop keying fileless detection on memfd_create specifics and instead watch execveat with AT_EMPTY_PATH against anonymous /tmp/# (deleted) executables, correlating prctl(PR_SET_NAME) renames and loaders that unlink /proc/self/exe, since this combination is absent from Elastic's FENIX 15-technique matrix.
Read the full story