Executive Summary
A specialized Linux fileless execution technique has been identified using a tool named 'Dntry'. This method leverages the kernel keyring subsystem (typically used for managing credentials like PAM or Kerberos) to stage ELF payloads directly in kernel slab memory. By using syscalls instead of creating file descriptors, the technique avoids common detection patterns that monitor for artifacts in /proc/self/fd/ or temporary files on disk.
The attack chain involves fetching a remote payload via HTTPS, using the `add_key` syscall to store it, and subsequently mapping it into anonymous userspace memory. The loader then manually maps ELF segments and performs a direct jump to the entry point, completely bypassing the `execve` syscall. This means no process start events are generated by traditional EDR monitoring that hooks standard execution paths.
This technique is highly effective for red teaming and advanced persistent threats because it leaves no trace on the virtual filesystem (VFS) and can operate within user-level quotas. While the loader binary itself remains a forensic artifact, the execution of the final payload occurs entirely in memory, making post-compromise detection significantly more difficult.