Linux - ShadowHS Fileless Process Masquerading

Ethan Andrews@eandrews

•updated Feb 27, 2026•1•0•34

Detects processes on Linux systems that exhibit fileless execution characteristics while masquerading as common shells or interpreters. This behavior is a key TTP of the ShadowHS post-exploitation framework, which uses argv spoofing and in-memory execution to evade detection.