Detects Linux process start events where a memfd_create syscall is invoked and the resulting executable is loaded from memory-backed or temporary locations, in combination with a host/process lineage (parent executable) that has not been observed previously. This behavior can indicate fileless execution using memory-resident ELF payloads accessed via /proc/self/fd, allowing code to run with minimal disk artifacts and reduced detectability. The rule targets Linux endpoints by filtering on Linux hosts, process start events, and memfd_create actions, while constraining the process executable to locations commonly used for in-memory or transient code (e.g., /tmp, /var/tmp, /dev/shm, /proc/*/fd/*) and ensuring there is a non-empty parent executable. By correlating new memfd_create activity with an unseen process lineage, the rule aims to surface attempts at reflective loading or process injection into memory (MITRE: T1620 Reflective Code Loading, T1055.009 Proc Memory, T1106 Native API) and to identify potential defense evasion through memory-only execution. The rule includes a mechanism (new_terms) to track new host/process lineage combinations over a rolling window (now-10d) to enrich detection history and enable triage of previously unseen relationships. It contributes to an in-progress investigation workflow that emphasizes lineage reconstruction, containment decisions, and cross-event correlation to detect follow-on behaviors such as outbound connections, credential use, or file modifications associated with the same process tree. The overall risk score is 47, and the rule is designed for use with Elastic Defend on Linux endpoints as part of a broader EDR strategy. Triage and investigation guidance, remediation steps, and containment recommendations are provided in the associated rule note. Analysts should validate whether the memfd-backed execution aligns with approved software and deployment patterns, correlate with network and authentication events, preserve relevant process memory and mappings for analysis if safe to do so, and isolate or terminate the implicated process tree if malicious activity is confirmed. If needed, rotate credentials and revoke tokens associated with the involved host/process lineage and hunt for additional hosts exhibiting matching lineage patterns or memfd-backed artifacts across the fleet.