T1027.011 Fileless Storage
Sub-technique of T1027 Obfuscated Files or Information
Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) Shared memory directories on Linux…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Process Execution From Shared Memory Directoryhighexperimental · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.