Detection of Linux Binary Execution from Shared Memory Directories

Security analysts have identified an increase in threat actors utilizing Linux shared memory directories, specifically /dev/shm/ and /run/shm/, to execute malicious binaries. These directories are backed by tmpfs, meaning they exist entirely in virtual memory and lack persistent storage on the physical disk. By staging and executing malware from these locations, attackers can maintain a footprint on high-uptime servers while effectively bypassing traditional disk-based forensic investigations. This activity is particularly concerning when performed by the root user, as it often signals the establishment of system backdoors or the final stages of privilege escalation. Monitoring for execution from these paths is a critical component of identifying stealthy post-exploitation activity on Linux endpoints.

Impact

Successful exploitation allows threat actors to maintain persistent, fileless backdoors on Linux infrastructure. Because these files do not persist on disk, detecting them requires real-time monitoring of process execution telemetry. Failure to detect this activity can lead to long-term unauthorized access, data exfiltration, and lateral movement within the environment without leaving traditional file-system artifacts for incident responders to analyze.

Recommendation

• Deploy the Sigma rules provided in this brief to monitor for process execution originating from /dev/shm/ and /run/shm/ by the root user.
• Enable Sysmon for Linux (EventID 1) or equivalent EDR telemetry to capture process path and command-line execution data.
• Configure SIEM alerts to filter out legitimate applications that utilize these directories for transient inter-process communication; establish a baseline of known-good software behavior to minimize false positives.
• Incorporate these detection points into incident response playbooks for Linux post-exploitation and privilege escalation hunts.