Linux Process Running from /dev/shm RAM Disk Attack

Linux Process Running from /dev/shm RAM Disk Attack

Publication Date: 19 December 2024

 

The Linux RAM disk in /dev/shm is a favorite place for malware to hide. The RAM disk is not frequently checked and is volatile so the malware can be sure it leaves not traces on disk if the system reboots. In this video we go over this attack, how to find it with Sandfly agentless Linux EDR, and command line forensics you can use to help investigate what may be happening


Sandfly is able to find this and many other types of Linux attacks without deploying any endpoint agents. Get your free license today or contact us for more information.

 


Share this post:

Deleted Process Binary Attack on Linux

Deleted Process Binary Attack on Linux

Linux malware often deletes its binary from the disk to evade detection and analysis. Learn how to detect and respond to this attack in this video.

Read More
Linux EDR Detecting Processes Running from Temporary Directory Attack

Linux EDR Detecting Processes Running from Temporary Directory Attack

A Linux process running from temporary directories is often malware. Learn about this Linux threat and how to detect it here.

Read More
Default User SSH Authorized Key Risks on Linux

Default User SSH Authorized Key Risks on Linux

Default Linux users can be used for persistent backdoors. Learn how to spot this risk with command line forensics and automatic threat detection.

Read More