Tag
Detection of root-level execution of binaries from volatile shared memory directories (/dev/shm/ and /run/shm/) used by threat actors for fileless persistence and forensic evasion.