MITRE ATT&CKsub-technique

T1027.011 Fileless Storage

Published 2023-03-23 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, Windows
Version
3.0
Created
2023-03-23

Description

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository. Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.. Similar to fileless in-memory behaviors such as Reflective Code Loading and Process Injection, fileless data storage may remain undetected by antivirus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux. Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of Persistence) and collected data not yet exfiltrated from the victim (e.g., Local Data Staging). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1027 Obfuscated Files or Information technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

Referenced by MITRE ATT&CK · uses (31)

  • C0055 Quad7 Activity campaign
  • S1145 Pikabot software (malware)
  • C0012 Operation CuckooBees campaign
  • S0673 DarkWatchman software (malware)
  • S0668 TinyTurla software (malware)
  • S0665 ThreatNeedle software (malware)
  • S0666 Gelsemium software (malware)
  • S0663 SysUpdate software (malware)
  • S0662 RCSession software (malware)
  • S0650 QakBot software (malware)
  • S0631 Chaes software (malware)
  • S0596 ShadowPad software (malware)
  • S0589 Sibot software (malware)
  • S0531 Grandoreiro software (malware)
  • S0511 RegDuke software (malware)
  • S0518 PolyglotDuke software (malware)
  • S0501 PipeMon software (malware)
  • S0496 REvil software (malware)
  • S0517 Pillowmint software (malware)
  • S0476 Valak software (malware)
  • S0343 Exaramel for Windows software (malware)
  • S0256 Mosquito software (malware)
  • S0263 TYPEFRAME software (malware)
  • S0269 QUADAGENT software (malware)
  • S0198 NETWIRE software (malware)
  • S0180 Volgmer software (malware)
  • G0050 APT32 group
  • G0010 Turla group
  • S0022 Uroburos software (malware)
  • S0023 CHOPSTICK software (malware)
Show all 31 ›

Referenced by Compliance · mitigates (1)

  • NIST-SI-4 System Monitoring NIST 800-53 control

References