Suspicious Process Execution From Shared Memory Directory (via process_creation)

This rule detects the execution of a binary from the Linux shared memory directory /dev/shm. This directory is a tmpfs mount backed entirely by RAM and is misused by adversaries for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.