Execution from in-memory tmpfs (/dev/shm)

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects execution of binaries or scripts from /dev/shm. Attackers use this in-memory filesystem to evade disk-based forensic scanning.