Detects potential Linux fileless ELF execution initiated from anonymous temporary files created via O_TMPFILE and executed using execveat with AT_EMPTY_PATH. The rule watches Linux process start events and flags processes whose executable path matches an anonymous temporary file pattern (e.g., a path component like /#<id>), which is indicative of O_TMPFILE usage that can bypass normal filesystem paths. This behavior is commonly associated with fileless or in-memory ELF payload execution and may be used to reduce disk artifacts. The rule operates on cross-source process start events (e.g., exec, start, process_started) and uses a regex to identify the anonymous path, enabling detection across diverse Linux environments and endpoint telemetry. The technique maps to MITRE ATT&CK Defense Evasion (Masquerading, T1036.005) and is aligned with high-severity threat monitoring. The rule is integrated with Elastic Defend/EDR data streams and supports multi-sensor coverage (Auditd Manager, Endgame, CrowdStrike, SentinelOne, etc.).