LoFP / unlikely in production environments; some container runtimes or ipc frameworks may use /dev/shm for inter-process communication but should not spawn executables.

Techniques

• t1027
• t1027.011

Sample rules

Process Execution From Shared Memory Directory

• source: sigma
• technicques:
  • t1027
  • t1027.011

Description

Detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.

Detection logic

condition: selection
selection:
  Image|startswith: /dev/shm/