With the wide adoption, Linux-based IoT devices have emerged as one primary target of today’s cyber attacks. While traditional malware-based attacks (e.g., Mirai) can quickly spread across these devices, they are well-understood threats with defense techniques such as malware fingerprinting coupled with community-based fingerprint sharing. Recently, fileless attacks—attacks that do not rely on malware files—have been increasingly occurring on Linux-based IoT devices.