[New Rule] Name of rule: Linux Fileless Execution via memfd_create

### Description

There are bunch of fileless execution techniques are quite powerful a linux environment. The most common and used one is the memfd_create.

### Target Ruleset

linux

### Target Rule Type

Custom (KQL or Lucene)

### Tested ECS Version

9.2.0

### Query

host.os.type:"linux" AND event.type:"start" AND
(
/* Detection Method 1: Executable path contains memfd reference */
process.executable:(*memfd* OR */memfd:* OR /proc/self/fd/*) OR

/* Detection Method 2: Process arguments reference memfd (excluding monitoring tools) */
(
process.args:(*memfd* OR */memfd:* OR /proc/self/fd/* OR /proc/*/fd/*) AND
NOT process.name:(ps OR lsof OR netstat OR ss)
) OR

/* Detection Method 3: Parent process is running from memfd */
process.parent.executable:(*memfd* OR */memfd:*)
) AND

/* Exclusions: Legitimate container runtimes */
NOT process.parent.name:(containerd OR dockerd OR cri-o OR containerd-shim OR systemd OR podman OR runc) AND

/* Exclusions: Standard system binaries */
NOT process.executable:(/usr/bin/* OR /usr/sbin/* OR /bin/* OR /sbin/*)

### New fields required in ECS/data sources for this rule?

_No response_

### Related issues or PRs

_No response_

### References

_No response_

### Redacted Example Data

_No response_