kevmap

TechniquesT1027.011 › AN0974

AN0974 Analytic 0974

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects usage of shared memory directories (/dev/shm, /run/shm) for temporary storage of obfuscated, encoded, or executable data without persistence to disk.</p>
Detects
T1027.011 Fileless Storage
Part of
DET0344 Detection Strategy for Fileless Storage via Registry, WMI, and Shared Memory

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
auditd:SYSCALLopen, write, unlinkDC0039 File Creation
linux:osqueryfile_events.pathDC0059 File Metadata

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
PathPrefixShared memory mount path used (e.g., /dev/shm/ or /run/shm/)
FilenameRegexRegex to match non-standard, suspicious, or encoded filenames
ExecCorrelationWindowTime window to correlate process execution from shared memory directories