Linux Process Execution from /dev/shm (Shared Memory)

title: Linux Process Execution from /dev/shm (Shared Memory)
id: 535a111c-759b-49e8-b72d-47cfdf438c06
status: experimental
description: This rule flags process creation where the executable path starts with /dev/shm/, indicating binaries are executed directly from the Linux shared memory filesystem. Attackers often use /dev/shm for short-lived staging to reduce disk artifacts and hinder disk-focused monitoring. Telemetry required is process creation logging with the spawned executable path.
references:
  - https://www.sysdig.com/blog/containers-read-only-fileless-malware
  - https://unfinished.bike/fun-with-the-new-bpfdoor-2023
  - https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf
  - https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/
  - https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7
  - https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_exec_from_dev_shm.yml
author: Stan Beukers, Huntrule Team
date: 2026-06-20
tags:
  - attack.stealth
  - attack.execution
  - attack.t1027.011
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|startswith: /dev/shm/
  condition: selection
falsepositives:
  - Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables.
level: high
license: DRL-1.1
related:
  - id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4
    type: derived