/tmp and /dev/shm Suspicious Files

Location

Description

World-writable temporary directories commonly used by attackers to stage tools, write exploit payloads, and store exfiltration archives. /dev/shm is a RAM-backed tmpfs that does not persist across reboots.

Forensic Value

Attackers default to /tmp and /dev/shm because these directories are world-writable and often excluded from file integrity monitoring. Finding ELF binaries, shell scripts, encoded payloads, or archive files (tar.gz, zip) in these locations is a strong compromise indicator. Files in /dev/shm are stored in RAM and will be lost on reboot, making live collection critical. Modification timestamps and file ownership link artifacts to specific accounts and timeframes.

Tools Required

Collection Commands

find /tmp /var/tmp /dev/shm -type f -exec file {} \; > /forensics/output/tmp_file_types.txt

tar czf /forensics/output/tmp_contents.tar.gz /tmp/ /var/tmp/ /dev/shm/

find /tmp /var/tmp /dev/shm -type f -executable -ls > /forensics/output/tmp_executables.txt

find /tmp /var/tmp /dev/shm -type f -exec stat --format="%n %U %G %y %s" {} \; > /forensics/output/tmp_metadata.txt

Collection Constraints

• •Paths and log sources vary by distribution, init system, logging stack, and installed packages. Validate the active distro and service set before treating absence as meaningful.

MITRE ATT&CK Techniques

References