[vahidmalekk]

Dataset

Adds a Linux auditd dataset capturing the memfd_create syscall used for fileless / in-memory ELF execution (MITRE ATT&CK T1620 - Reflective Code Loading).

Technique: An adversary allocates an anonymous in-memory file with memfd_create, writes an ELF payload into it, and executes it via execveat(fd, "", ..., AT_EMPTY_PATH) - leaving no executable on disk. The kernel emits a SYSCALL record for memfd_create (key anon_file_create), which is the reliable signal because the execveat that runs the in-memory image is commonly not covered by execve audit watches.

Path: datasets/attack_techniques/T1620/linux_auditd_memfd_create/linux_auditd_memfd_create.log

Format: auditd (source=auditd, sourcetype=auditd), PROCTITLE + SYSCALL records, 3 memfd_create events from a loader process.

Collected on an authorized lab host. Pairs with a companion detection PR in splunk/security_content (linux_auditd_memfd_create_fileless_execution).