Wiki › Techniques, Tactics & Procedures (TTPs) › Defense Evasion › Fileless Malware Techniques

Fileless Malware Techniques

3 min read

Jump to:

Overview

Fileless malware techniques involve executing malicious activities without writing files to disk, leveraging legitimate system tools and memory-resident code. These techniques are used throughout various stages of the attack lifecycle to evade traditional file-based detection mechanisms and maintain stealth. Adversaries employ fileless methods to reduce forensic artifacts and complicate incident response efforts.

Attack Objective

Achieve stealthy execution and persistence without leaving file-based evidence
Supports multiple attack lifecycle stages including Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, and Lateral Movement
Advances attacker position by enabling covert operations, reducing detection likelihood, and facilitating sustained control over compromised environments

How the Technique Works

Fileless malware techniques operate by utilizing legitimate system processes, scripts, or memory-resident code to perform malicious actions. Instead of deploying executable files on disk, adversaries exploit trusted tools such as PowerShell, Windows Management Instrumentation (WMI), or macros to execute payloads directly in memory. This approach minimizes persistent artifacts and leverages existing system functionality to carry out commands, escalate privileges, or move laterally.

Common Methods & Variations

Use of scripting environments like PowerShell, JavaScript, or VBScript for in-memory code execution
Abuse of WMI event subscriptions or scheduled tasks for persistence without files
Leveraging legitimate administrative tools (living-off-the-land binaries) such as rundll32, regsvr32, or mshta
Memory injection techniques including reflective DLL injection or process hollowing
Variants targeting on-premises endpoints, cloud workloads, or identity systems via script-based or API-driven approaches

Indicators of Compromise (IOCs)

Unusual or unauthorized execution of scripting engines and system utilities
Suspicious command-line arguments or encoded scripts in process creation logs
Unexpected WMI event subscriptions or scheduled task creations without corresponding files
Memory anomalies detected through endpoint detection and response (EDR) tools
Network traffic patterns indicative of command and control without associated file downloads

Detection Strategies

Monitoring process creation events and command-line parameters for script execution
Behavioral analysis focusing on anomalous use of system tools and in-memory code execution
Correlation of WMI and scheduled task activity with user behavior and system baselines
Utilization of endpoint telemetry including memory scans and process injection detection
Network monitoring for covert command and control channels lacking file transfer signatures

Mitigation & Prevention

Application whitelisting to restrict execution of unauthorized scripts and binaries
Disabling or restricting use of scripting engines and administrative tools where not required
Implementing least privilege principles to limit user and process capabilities
Enforcing multi-factor authentication and robust identity management
Regular patching and system hardening to reduce exploitation vectors

Response Considerations

Immediate isolation of affected systems to prevent lateral movement
Comprehensive memory and process analysis to identify in-memory payloads and injected code
Review of system and security logs for anomalous script or tool usage
Removal or disabling of malicious WMI subscriptions, scheduled tasks, or persistence mechanisms
Post-incident hardening including policy updates and enhanced monitoring configurations

Related Techniques

Living-off-the-land binaries and scripts (LOLBAS) abuse
Process injection and code injection techniques
Credential dumping and privilege escalation methods
Command and control via covert channels
Persistence through WMI or scheduled tasks without files

Mapping & References

MITRE ATT&CK TTPs: T1055 (Process Injection), T1086 (PowerShell), T1047 (Windows Management Instrumentation), T1053 (Scheduled Task/Job), T1071 (Application Layer Protocol)
Public research and advisories from cybersecurity organizations detailing fileless attack campaigns and detection methodologies
Incident reports highlighting real-world use of fileless techniques in advanced persistent threats (APTs)

Tags: cyber threats Defense Evasion endpoint security Execution Techniques Fileless Malware Living-off-the-Land persistence PowerShell Abuse Process Injection WMI Abuse