T1027.011 — Fileless Storage

Tactic: Stealth · Platforms: Linux, Windows

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (2)

T1027.011 Obfuscated Files or Information: Fileless Storage

title: "T1027.011 Obfuscated Files or Information: Fileless Storage"
id: 805587b0-78a7-4f15-91d6-cac67c7fcf71
description: 'Detects fileless storage via Security-log EventID 4657 registry value modification. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: RegistryPathFilter, PayloadEntropyThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/011
author: Shahrukh Khan
date: 2026-04-30
license: MIT
tags:
  - attack.stealth
  - attack.t1027.011

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4657'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  filter_noisy_paths:
    ObjectName|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Explorer\'
      - '\Software\Classes\Local Settings\'
  condition: selection and not filter_system_account and not filter_noisy_paths

falsepositives:
  - Requires SACL auditing; normal shell/explorer churn excluded.

level: medium

T1027.011 Obfuscated Files or Information: Fileless Storage

title: "T1027.011 Obfuscated Files or Information: Fileless Storage - Memfd-based"
id: bb9a3198-e288-44c6-a5ef-47004e4664be
description: 'Detection Strategy for Fileless Storage via memfd_create. (Retargeted to the process_creation/syscall auditd telemetry that actually captures this techniques behavior; see logsource below.) Split out of the original combined rule, which incorrectly paired a type: SYSCALL memfd_create selector with a category: file_event logsource; memfd_create is a process/syscall-level event, not a file_event. Adds exe-based exclusions for well-known legitimate memfd_create callers (Chrome/Chromium, Firefox, systemd, containerd) to reduce noise. Tune using: PathPrefix, FilenameRegex, ExecCorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/011
author: Shahrukh Khan
date: 2026-06-20
license: MIT
tags:
  - attack.stealth
  - attack.t1027.011

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: SYSCALL
    syscall: memfd_create
  filter_legitimate_callers:
    exe|contains:
      - '/opt/google/chrome/chrome'
      - '/usr/lib/chromium/chromium'
      - '/usr/lib/firefox/firefox'
      - '/usr/lib/systemd/systemd'
      - '/usr/bin/containerd'
      - '/usr/bin/containerd-shim'
  condition: selection and not filter_legitimate_callers

falsepositives:
  - Other browsers or sandboxing/container runtimes not on the exclusion list also use memfd_create for benign IPC/caching; extend filter_legitimate_callers as new legitimate callers are identified.

level: high

---
title: "T1027.011 Obfuscated Files or Information: Fileless Storage - Shared Memory Directory Write"
id: 4a1f8e6c-2d9b-4c73-8b5e-7f0a3d6c9e12
description: 'Detection Strategy for Fileless Storage via shared-memory-directory file creation. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Split out of the original combined rule so that the PATH-based /dev/shm CREATE selector runs under its correct file_event logsource rather than being merged with the unrelated memfd_create syscall selector. Tune using: PathPrefix, FilenameRegex, ExecCorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/011
author: Shahrukh Khan
date: 2026-06-20
license: MIT
tags:
  - attack.stealth
  - attack.t1027.011

logsource:
  category: file_event
  product: linux

detection:
  selection_shm:
    type: PATH
    name|startswith: '/dev/shm/'
    nametype: CREATE
  condition: selection_shm

falsepositives:
  - Some legitimate applications use /dev/shm for benign IPC/caching (e.g. POSIX shared memory segments created by database engines or media frameworks); scope PathPrefix/FilenameRegex to exclude known-good application subdirectories under /dev/shm.

level: medium

Related sub-techniques

Explore