VoidLink Fileless Execution via Kernel Thread Masquerading
Detects the VoidLink malware's initial dropper behavior, where a process masquerading as a kernel thread executes a payload from memory. This is indicative of the memfd_create and execveat fileless execution technique used by VoidLink, characterized by a process created with no FolderPath or FileName, initiated by a process named like a kernel thread.
Microsoft Sentinel (KQL)
