Fileless Malware

Introduction

Fileless malware operates entirely in memory without writing executable files to disk. It abuses legitimate system tools (PowerShell, WMI, .NET, macros, LOLBins) to execute malicious code, making traditional file-based AV detection ineffective.

History

Milestone	Year	Details
SQL Slammer	2003	Pure memory worm; no disk
Poweliks	2014	Registry-stored PowerShell
Kovter	2015	Fileless click fraud
Duqu 2.0	2015	APT; kernel memory only
PowerSniff	2016	PowerShell + macros
Emotet	2017+	PowerShell + LOLBins
Astaroth	2018	.NET, WMI, living-off-land

Execution Techniques

Technique	LOLBin	Description
PowerShell	powershell.exe	-EncodedCommand, -WindowStyle Hidden
WMI	wmic.exe, wmiprvse.exe	Event subscription, process creation
HTA	mshta.exe	Execute HTML Application
Certutil	certutil.exe	-decode, -urlcache
Regsvr32	regsvr32.exe	/s /u /i:http://... scrobj.dll
Msbuild	msbuild.exe	Inline C# task
InstallUtil	InstallUtil.exe	/logfile= /LogToConsole=false
Scripting	cscript.exe, wscript.exe	VBScript, JScript
.NET Assembly	Assembly.Load()	Reflectively load from memory

Attack Flow

1. INITIAL ACCESS
   └─ Phishing (macro), exploit, LNK, ISO

2. INITIAL EXECUTION
   └─ Macro → PowerShell → Download stage 2

3. MEMORY-ONLY EXECUTION
   └─ Reflectively load .NET assembly
   └─ Inject into legitimate process (rundll32, svchost)

4. PERSISTENCE
   └─ WMI Event Subscription (Filter + Consumer)
   └─ Scheduled Task (PowerShell command)
   └─ Registry Run Key (PowerShell encoded)

4. LIVING OFF THE LAND
   └─ Use built-in tools for all actions
   └─ No custom binaries on disk

Notable Families

Family	Year	Technique	Notable
Poweliks	2014	Registry + PowerShell	First mainstream fileless
Kovter	2015	Registry + shell	Click fraud
Duqu 2.0	2015	Kernel memory only	APT, nation-state
Emotet	2017+	PowerShell + LOLBins	Loader platform
Astaroth	2018	.NET, WMI, LOLBins	Banking theft
Frodo	2019	.NET, WMI	Info stealer

Detection

Method	Description
ETW / ETW-TI	Event Tracing for Windows + Threat Intelligence
AMSI	Antimalware Scan Interface — inspects script content
Script Block Logging	PowerShell transcript + module logging
EDR Memory Scanning	Scan process memory for shellcode, assemblies
Behavioral	Unusual process chains (winword → powershell)
WMI Monitoring	Event subscription creation (Event ID 5860/5861)
Memory Forensics	Volatility3: windows.memmap, windows.malfind

Prevention

• ✅ Enable AMSI — Inspect all script content at runtime
• ✅ PowerShell Script Block Logging — Full transcript
• ✅ Enable Constrained Language Mode — Restrict .NET
• ✅ Application Control — WDAC, AppLocker, block LOLBins
• ✅ EDR with memory scanning — Scan process memory
• ✅ Disable WMI event subscriptions unless needed
• ✅ Macro blocking — Block internet macros, signed only
• ✅ Network monitoring — Beaconing, unusual PowerShell net

MITRE ATT&CK

Technique	ID	Description
PowerShell	T1059.001	PowerShell execution
WMI	T1047	WMI for execution
Scheduled Task	T1053.005	Persistence
Registry Run Keys	T1547.001	Persistence
Obfuscated Files	T1027	Encoded commands
Process Injection	T1055	Memory injection

Related

• APT Malware — Heavy fileless usage
• Living Off The Land — Tool abuse
• Memory Forensics — Detection