Potential Fileless Execution via O_TMPFILE

This rule identifies potential fileless ELF execution where a process is launched from an anonymous temporary executable path that appears as "/#<id>" in "process.executable". This pattern may be associated with "O_TMPFILE" and "execveat" with "AT_EMPTY_PATH", which can allow execution without a normal filesystem pathname.

Rule type: eql
Rule indices:

  • auditbeat-*
  • endgame-*
  • logs-crowdstrike.fdr*
  • logs-endpoint.events.process-*
  • logs-sentinel_one_cloud_funnel.*
  • logs-auditd_manager.auditd-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • OS: Linux
  • Platform: Linux
  • Use Case: Threat Detection
  • Tactic: Defense Evasion
  • Rule Type: Event Correlation (EQL)
  • Data Source: Auditd Manager
  • Data Source: Elastic Defend
  • Data Source: Elastic Endgame
  • Data Source: Crowdstrike
  • Data Source: SentinelOne
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires data coming in from Elastic Defend.

Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.

  • Fleet is required for Elastic Defend.
  • To configure Fleet Server refer to the documentation.
  • Go to the Kibana home page and click "Add integrations".
  • In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
  • Click "Add Elastic Defend".
  • Configure the integration name and optionally add a description.
  • Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
  • Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. Helper guide.
  • We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
  • Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead. For more details on Elastic Agent configuration settings, refer to the helper guide.
  • Click "Save and Continue".
  • To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts. For more details on Elastic Defend refer to the helper guide.

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

This rule detects Linux processes launched from anonymous temporary files created with O_TMPFILE, a pattern associated with execveat and AT_EMPTY_PATH execution that leaves no normal filesystem pathname. An attacker can write a malicious ELF payload into an unnamed file descriptor and execute it directly, reducing disk artifacts and making the payload harder to discover through routine file inspection.

  • Preserve volatile evidence from the live process by collecting its /proc/<pid>/exe, file descriptors, memory maps, command line, environment, namespaces, and a hash or copy of the anonymous executable where policy permits.
  • Reconstruct the full process ancestry and execution context, focusing on the initiating user, parent binary, container or service identity, privilege changes, and whether the chain originated from a shell, web service, or remote session.
  • Correlate audit telemetry for the preceding openat or openat2 call using O_TMPFILE, subsequent writes and permission changes, and the final execveat call using AT_EMPTY_PATH.
  • Review nearby network, authentication, and endpoint activity for payload delivery, command-and-control connections, credential access, persistence creation, lateral movement, or additional spawned processes.
  • Determine prevalence across hosts and compare hashes, ancestry, and execution context with approved software, escalating isolated or unsigned occurrences and containing affected systems when malicious behavior is confirmed.
  • Legitimate system or application software may use O_TMPFILE for secure temporary execution, so verify the process ancestry, executable hash, package ownership, and consistency with approved activity.
  • Authorized software installation, update, or testing workflows may execute an anonymous ELF binary, so confirm the timing against approved changes and validate the initiating user, service, and expected recurrence across comparable hosts.
  • Isolate the affected Linux host or container from the network while preserving /proc/<pid>/exe, open file descriptors, memory, and relevant audit logs for forensic analysis.
  • Terminate the malicious process tree, revoke exposed credentials and active sessions, and block identified executable hashes, command-and-control destinations, and payload sources across the environment.
  • Remove attacker persistence from systemd units, cron jobs, shell profiles, SSH authorized_keys, startup scripts, modified containers, and unauthorized accounts or packages.
  • Escalate immediately to incident response if privileged execution, credential theft, command-and-control traffic, persistence, or activity on additional hosts is identified.
  • Reimage compromised systems from known-good media, restore validated data, rotate affected secrets, patch the initial access vector, and verify that no anonymous executable or related attacker activity remains.
  • Harden Linux endpoints by restricting unnecessary O_TMPFILE and execveat behavior through application allowlisting, SELinux or AppArmor policies, container controls, and enhanced auditing of anonymous-file execution.
process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.executable regex """.*/\#[0-9]+.*"""

Framework: MITRE ATT&CK