Linux Process Execution from /dev/shm Shared Memory Directory
Alerts on Linux processes executing binaries from /dev/shm, a common in-memory staging location.
- Product
- linux
- Category
- process_creation
- Author
- Stan Beukers (SigmaHQ), DRL 1.1
- Published
- 2026-06-20
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation where the executable path starts with /dev/shm/, indicating a binary was launched directly from the Linux shared memory mount. Attackers commonly use /dev/shm to stage payloads in a RAM-backed location to reduce disk visibility and potentially evade disk-focused monitoring. It relies on Linux process creation telemetry that includes the executed image path.
Reporting behind it
- sysdig.comhttps://www.sysdig.com/blog/containers-read-only-fileless-malware
- unfinished.bikehttps://unfinished.bike/fun-with-the-new-bpfdoor-2023
- asiapacificdefencereporter.comhttps://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf
- crowdstrike.comhttps://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/
- linkedin.comhttps://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7
- stormshield.comhttps://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_exec_from_dev_shm.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Execution from /dev/shm Shared Memory Directory
id: 535a111c-759b-49e8-b72d-47cfdf438c06
status: experimental
description: This rule identifies process creation where the executable path starts with /dev/shm/, indicating a binary was launched directly from the Linux shared memory mount. Attackers commonly use /dev/shm to stage payloads in a RAM-backed location to reduce disk visibility and potentially evade disk-focused monitoring. It relies on Linux process creation telemetry that includes the executed image path.
references:
- https://www.sysdig.com/blog/containers-read-only-fileless-malware
- https://unfinished.bike/fun-with-the-new-bpfdoor-2023
- https://asiapacificdefencereporter.com/wp-content/uploads/2023/08/Final-CRWD-2023-Threat-Hunting-Report.pdf
- https://www.crowdstrike.com/en-us/blog/how-to-hunt-for-decisivearchitect-and-justforfun-implant/
- https://www.linkedin.com/posts/avradeep_malware-apt-infostealer-activity-7373203959697719296-JR-7
- https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_exec_from_dev_shm.yml
author: Stan Beukers, Huntrule Team
date: 2026-06-20
tags:
- attack.stealth
- attack.execution
- attack.t1027.011
logsource:
category: process_creation
product: linux
detection:
selection:
Image|startswith: /dev/shm/
condition: selection
falsepositives:
- Unlikely in production environments; some container runtimes or IPC frameworks may use /dev/shm for inter-process communication but should not spawn executables.
level: high
license: DRL-1.1
related:
- id: 5cd16c8f-44a6-4654-81e7-a84d6db507d4
type: derived