{"id":"5cd16c8f-44a6-4654-81e7-a84d6db507d4","title":"Process Execution From Shared Memory Directory","description":"Detects the execution of a binary from the Linux shared memory directory /dev/shm.\nThis directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.\n","author":"Stan Beukers","status":"experimental","level":"high","date":"2026-06-20","modified":"","tags":["attack.stealth","attack.execution","attack.t1027.011"],"technique_ids":["T1027.011"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables."],"references":["https://www.sysdig.com/blog/containers-read-only-fileless-malware","https://unfinished.bike/fun-with-the-new-bpfdoor-2023","https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf","https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/","https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7","https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/"],"source_path":"rules/linux/process_creation/proc_creation_lnx_susp_exec_from_dev_shm.yml","source_sha256":"f61743884a890d07fbbfb5c811468f593815ae4ea6abdc872c5abd028dc56a9b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_exec_from_dev_shm.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Process Execution From Shared Memory Directory\nid: 5cd16c8f-44a6-4654-81e7-a84d6db507d4\nstatus: experimental\ndescription: |\n    Detects the execution of a binary from the Linux shared memory directory /dev/shm.\n    This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.\nreferences:\n    - https://www.sysdig.com/blog/containers-read-only-fileless-malware\n    - https://unfinished.bike/fun-with-the-new-bpfdoor-2023\n    - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf\n    - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/\n    - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7\n    - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/\nauthor: Stan Beukers\ndate: 2026-06-20\ntags:\n    - attack.stealth\n    - attack.execution\n    - attack.t1027.011\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection:\n        Image|startswith: '/dev/shm/'\n    condition: selection\nfalsepositives:\n    - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027.011","id":"T1027.011","name":"Fileless Storage","page":"techniques/enterprise/T1027.011/"}],"data_path":"data/detection-rules/5cd16c8f-44a6-4654-81e7-a84d6db507d4.json","kind":"sigma"}