ATT&CK coverage › Technique

Obfuscated Files or Information: Fileless Storage T1027.011

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository. Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk..

Events covered

2 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

Patterns shared across the 3 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (5 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Details2in 1, eq 1"*[Back]*", "*[TAP]*", "*[ENTER]*", *
ScriptBlockText1in 1, eq 1"*IO.MemoryStream*", "*system.net.webclient*", "*system.net.webrequest*"
EventID1eq 14104
registry_path1eq 1"*\\[kl]"
reg_data_len1gt 1512

Top indicator values (10 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
ScriptBlockTextin"*system.net.webrequest*"1
EventIDeq41041108
ScriptBlockTexteq"*IO.MemoryStream*"1
ScriptBlockTextin"*system.net.webclient*"1
Detailsin"*[TAP]*"1
registry_patheq"*\\[kl]"1
Detailsin"*[ENTER]*"1
Detailsin"*[Back]*"1
reg_data_lengt5121
Detailseq*1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Splunk 3 rules