Execution from /dev/shm

Description

This rule detects file execution in the /dev/shm directory, a tactic often used by threat actors to store their readable, writable, and occasionally executable files. /dev/shm acts as a link to the host or other containers, creating vulnerabilities for their compromise as well. Notably, /dev/shm remains unchanged even after a container restart. Consider this rule alongside the newer "Drop and execute new binary in container" rule.

Query · falco

spawned_process and (proc.exe startswith "/dev/shm/" or
    (proc.cwd startswith "/dev/shm/" and proc.exe startswith "./" ) or
    (shell_procs and proc.args startswith "-c /dev/shm") or
    (shell_procs and proc.args startswith "-i /dev/shm") or
    (shell_procs and proc.args startswith "/dev/shm") or
    (proc.cwd startswith "/dev/shm/" and proc.args startswith "./" ))
and not container.image.repository in (falco_privileged_images, trusted_images)

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro shell_procs
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.

Analyst notes

File execution detected from /dev/shm | evt_res=%evt.res file=%fd.name proc_cwd=%proc.cwd proc_pcmdline=%proc.pcmdline user_loginname=%user.loginname group_gid=%group.gid group_name=%group.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Execution from /dev/shm · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Execution from /dev/shm
desc: 'This rule detects file execution in the /dev/shm directory, a tactic often
  used by threat actors to store their readable, writable, and occasionally executable
  files. /dev/shm acts as a link to the host or other containers, creating vulnerabilities
  for their compromise as well. Notably, /dev/shm remains unchanged even after a container
  restart. Consider this rule alongside the newer "Drop and execute new binary in
  container" rule.

  '
condition: "spawned_process and (proc.exe startswith \"/dev/shm/\" or\n    (proc.cwd\
  \ startswith \"/dev/shm/\" and proc.exe startswith \"./\" ) or\n    (shell_procs\
  \ and proc.args startswith \"-c /dev/shm\") or\n    (shell_procs and proc.args startswith\
  \ \"-i /dev/shm\") or\n    (shell_procs and proc.args startswith \"/dev/shm\") or\n\
  \    (proc.cwd startswith \"/dev/shm/\" and proc.args startswith \"./\" ))\nand\
  \ not container.image.repository in (falco_privileged_images, trusted_images)\n"
output: File execution detected from /dev/shm | evt_res=%evt.res file=%fd.name proc_cwd=%proc.cwd
  proc_pcmdline=%proc.pcmdline user_loginname=%user.loginname group_gid=%group.gid
  group_name=%group.name evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_stable
- host
- container
- mitre_execution
- T1059.004

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.