In-Memory ELF Execution via memfd_create

Tim Peck@timpeck

•updated Jan 13, 2026•4•1•165

Detects the creation and execution of anonymous memory-backed files using `memfd_create`. This technique is used by malware like VoidLink to execute modular plugins or payloads directly in memory, bypassing disk-based detection mechanisms.