Python In-Memory Execution via ProcFS

Tim Peck@timpeck

•updated Jan 22, 2026•9•0•67

Detects a Python process executing a binary from an in-memory file descriptor via the /proc filesystem. This technique was observed in the malicious 'sympy-dev' PyPI package, which used it to execute a cryptominer from memory, bypassing some file-based detections.