APT32G0050 ↗
APT32's backdoor has stored its configuration in a registry key.1
tfMITRE ATT&CK sub-technique
Fileless Storage T1027.011
sub-technique of T1027 Obfuscated Files or Information
- Tactic
- Stealth
- Platforms
- Linux, Windows
- Version
- 3.0
- Created
- 23 March 2023
- Last modified
- 12 May 2026
- Contributors
- Christopher Peacock; Denise Tan; Mark Wee; Simona David; Vito Alfano, Group-IB; Xavier Rousseau
Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.[1][2] Shared memory directories on Linux systems (/dev/shm, /run/shm, /var/run, and /var/lock) and volatile directories on Network Devices (/tmp and /volatile) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.[3][4][5][6][7].
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.27
Tools & malwareTop 13%
Tools & malware87th percentile · 87% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Fileless Storage MITRE reference T1027.011
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 2 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Quad7 ActivityC0055 ↗
Has infected victim network devices by storing artifacts in the /tmp directory which is volatile in memory and will clear its contents upon shutdown or restart.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.1
All 2 campaigns for this technique
27 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PikabotS1145 ↗
Some versions of Pikabot build the final PE payload in memory to avoid writing contents to disk on the executing machine.1
DarkWatchmanS0673 ↗
Can store configuration strings, keylogger, and output of components in the Registry.1
TinyTurlaS0668 ↗
Can save its configuration parameters in the Registry.1
GelsemiumS0666 ↗
Can store its components in the Registry.1
ThreatNeedleS0665 ↗
Can save its configuration data as a RC4-encrypted Registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon.1
SysUpdateS0663 ↗
Can store its encoded configuration file within Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.1
All 27 software entries for this technique · 6 newest in this preview
Offense vs defense T1027.011
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 3
first rule: 2023 Q2 · 2 of 2 campaigns plottedFileless Storage detection strategy DET0344
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Fileless Storage via Registry, WMI, and Shared Memory
2 platforms
AN0973 · Windows
Detects abuse of fileless storage mechanisms such as Registry keys, WMI classes, and Event Logs used to stage payloads, scripts, or encoded content outside traditional files.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| WMI CreationDC0008 | WinEventLog:Application | WMI Object Creation Events |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RegistryPathFilter | Scoped to suspicious or abused paths like HKCU\Software\Classes\ or HKLM\SYSTEM\CurrentControlSet\Services\ |
| PayloadEntropyThreshold | Minimum entropy level to flag suspicious registry or WMI content as encoded payloads |
| TimeWindow | Temporal window for correlating WMI/registry modifications with process creation or network usage |
AN0974 · Linux
Detects usage of shared memory directories (/dev/shm, /run/shm) for temporary storage of obfuscated, encoded, or executable data without persistence to disk.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | auditd:SYSCALL | open, write, unlink |
| File MetadataDC0059 | linux:osquery | file_events.path |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PathPrefix | Shared memory mount path used (e.g., /dev/shm/ or /run/shm/) |
| FilenameRegex | Regex to match non-standard, suspicious, or encoded filenames |
| ExecCorrelationWindow | Time window to correlate process execution from shared memory directories |
AuditM1047
Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.