Fileless Storage
Subtechnique · ATTACK:enterprise:T1027.011
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1027.011",
"title": "Fileless Storage",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1027/011",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--02c5abff-30bf-4703-ab92-1f6072fae939",
"external_id": "T1027.011",
"domain": "enterprise",
"created": "2023-03-23T19:55:25.546Z",
"modified": "2026-05-12T15:12:00.619Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "Aquasec Muhstik Malware 2024",
"url": "https://www.aquasec.com/blog/muhstik-malware-targets-message-queuing-services-applications/"
},
{
"source_name": "Bitsight 7777 Botnet",
"url": "https://www.bitsight.com/blog/7777-botnet-insights-multi-target-botnet"
},
{
"source_name": "CISCO Nexus 900 Config",
"url": "https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/fundamentals/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Fundamentals_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Fundamentals_Configuration_Guide_7x_chapter_01000.html"
},
{
"source_name": "Elastic Binary Executed from Shared Memory Directory",
"url": "https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-7-16-3-binary-executed-from-shared-memory-directory.html"
},
{
"source_name": "SecureList Fileless",
"url": "https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/"
},
{
"source_name": "Microsoft Fileless",
"url": "https://learn.microsoft.com/microsoft-365/security/intelligence/fileless-threats"
},
{
"source_name": "Sysdig Fileless Malware 23022",
"url": "https://sysdig.com/blog/containers-read-only-fileless-malware/"
},
{
"source_name": "Akami Frog4Shell 2024",
"url": "https://www.akamai.com/blog/security-research/fritzfrog-botnet-new-capabilities-log4shell"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19151c17-b3cb-436f-88dc-16aabd96e04f
Prevailion DarkWatchman 2021ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b45a635-4384-4cce-ac50-49826659dcb2
ESET Dukes October 2019ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e9e3384-b624-46aa-9a15-eff8eae2b6e1
Group IB Ransomware September 2020 · Red Canary QbotATTACK:enterprise:S0263 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a11bfd9-1c27-4f54-926d-883cfa9b69cd
US-CERT TYPEFRAME June 2018ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3de96229-d45b-47b2-9515-4eadd0023115
ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--414a365a-e24b-44f2-8130-77435f2e18ef
CISA ComRAT Oct 2020 · ESET ComRAT May 2020ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4459b6fe-e1d0-40cb-b6f1-efc0e4431442
TrendMicro EarthLusca 2022 · Kaspersky ShadowPad Aug 2017ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fba775c-148d-4fc5-b56a-d5600b23654d
ESET Gelsemium June 2021ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59336377-92b2-4a82-97a1-414710a0a3dc
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--596099b1-11a9-43c3-ae21-d5a31233e5c2
Trend Micro Iron Tiger April 2021ATTACK:enterprise:T1027.011 → subtechnique-of → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59b7cc7f-469c-4dba-8ee0-4d458777abe7
ATTACK:enterprise:S0343 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f3176fa-827b-4c3c-ba71-6e8ef6cdebb9
ESET TeleBots Oct 2018ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f488c35-1d8c-4596-985c-11f0ee37b004
ESET Grandoreiro April 2020ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64cf2e56-3d7e-4999-a0ae-eb856b8e8f20
Red Canary NETWIRE January 2020ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--690d1b72-9fb0-426a-9db4-075abf045688
Trustwave Pillowmint June 2020ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73aee1df-5faf-456f-8bde-74b531c1c2b9
Talos TinyTurla September 2021ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a6bfa36-adff-402d-9913-be2e45bc22aa
FireEye APT28ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cc515c2-01b6-4cd7-a928-1131ffe5f11c
ESET OceanLotus Mar 2019ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dc92a18-99e3-47ce-8b63-ad6df5851e31
Elastic Pikabot 2024ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91aa29c1-28a9-414a-aa3c-a6293b8d078f
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0511 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d9b0e66-5b9d-4711-8e5a-23e2807ce7ef
ESET Dukes October 2019ATTACK:enterprise:S0665 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9de8aee7-1867-48a4-9a78-3076853e43ac
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a23a8716-ffd4-407e-9890-99a416c35efa
Bitsight 7777 BotnetATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2648a96-b282-4624-a91c-f97688c2f3b1
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a40a85bf-69d3-4164-a735-fb9ecc7b656e
Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab4acf2d-7761-4f78-92eb-cbd4fea45929
US-CERT Volgmer Nov 2017 · Symantec Volgmer Aug 2014ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b44bf5b1-42f8-4c70-9108-9699e8fa66ec
Cybereason Chaes Nov 2020ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd437a82-65df-42d7-a73b-6ed63a4cdd63
ESET Turla PowerShell May 2019 · Symantec Waterbug Jun 2019ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8f956ea-84ef-4232-b281-59c40f019753
Profero APT27 December 2020 · Trend Micro DRBControl February 2020ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df891390-43d8-4201-aebc-51c20cae5897
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e27416ae-e9f1-4b3f-90b2-6cb4a1a6abf4
ESET PipeMon May 2020ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f292f16f-ab6e-42ef-94f5-d65792fe5df8
Secureworks REvil September 2019 · Cylance Sodinokibi July 2019 · Intel 471 REvil March 2020 · McAfee Sodinokibi October 2019 · Secureworks GandCrab and REvil September 2019ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f37a0b65-043e-45f9-9e70-06ad9d75e856
ESET Turla Mosquito Jan 2018