What Is Fileless Malware?
Fileless malware executes in memory using legitimate tools, leaving no files for security scanners to detect.
Fileless Malware Techniques
Living Off the Land
Living-off-the-land attacks use legitimate system tools and binaries — PowerShell, Windows Management Instrumentation (WMI), certutil, mshta, regsvr32, rundll32 — to execute malicious actions without deploying custom malware files. These tools are present on every Windows system, their use is expected in enterprise environments, and security products must carefully balance flagging legitimate administrative use against detecting malicious abuse. The attacker's payload is a series of legitimate tool invocations chained to achieve malicious objectives, with no unique malware binary to detect.
Memory-Only Execution
Process injection attacks inject malicious code into the memory space of legitimate running processes. Rather than executing from a file, the malicious code runs within a trusted process — lsass.exe, svchost.exe, explorer.exe — inheriting that process's trust level and access permissions. From a file system perspective, no malicious file exists. From a network perspective, communications appear to originate from the legitimate process. Detection requires memory analysis or behavioral monitoring of process activities rather than file scanning.
Registry and WMI Persistence
Fileless malware achieves persistence through Windows Registry keys, WMI subscriptions, and scheduled tasks rather than executable files on disk. A malicious WMI event subscription that executes a PowerShell command from the registry when a specific system event occurs leaves no executable file on disk but survives reboots and credential rotations. Registry-based persistence stores encoded payloads in registry keys that are executed by legitimate system processes through script interpreters.
Why Fileless Attacks Evade Traditional Defenses
Traditional antivirus and endpoint protection products detect malware primarily through file scanning — comparing files on disk against databases of known malicious signatures. Fileless malware, by definition, does not reside in files that security products scan. The malicious code executes from memory, legitimate tools, or system facilities that security products must treat as trusted to avoid overwhelming false positives.
Behavioral detection — identifying malicious activity patterns rather than malicious files — is the primary detection mechanism for fileless attacks. A PowerShell process that spawns a network connection to an external IP address, reads sensitive files, and encodes its output in base64 before transmitting it displays a behavioral pattern associated with malicious use regardless of which legitimate system binary executes it. EDR platforms with behavioral detection provide meaningfully better coverage against fileless attacks than traditional antivirus, but require tuning to maintain signal quality against legitimate PowerShell administrative activity.
Defending Against Fileless Malware
PowerShell execution policy enforcement limits what PowerShell scripts can run — requiring code signing for scripts, disabling PowerShell remoting where not required, and enabling PowerShell ScriptBlock Logging to record all PowerShell activity for forensic analysis and detection. Application allowlisting — enforcing that only approved applications can execute — prevents the execution of unauthorized tools even when delivered without files, because even fileless attacks typically require executing some initial access payload.
Memory scanning and process injection detection in EDR platforms specifically addresses in-memory execution. Behavioral rules that flag processes exhibiting suspicious activity patterns — a legitimate system process spawning unexpected child processes, making unusual network connections, or accessing sensitive memory regions — provide detection coverage that file-based scanning cannot.
Related Reading
What is fileless malware?
Fileless malware is malicious code that operates entirely in memory and uses legitimate Windows tools — PowerShell, WMI, certutil, mshta, rundll32 — to conduct malicious activity without writing files to disk. Because traditional antivirus relies on scanning files, fileless techniques evade signature-based detection entirely. The malware exists only as running processes and in-memory code that is destroyed when the system reboots, leaving minimal forensic evidence.
How is fileless malware different from traditional malware?
Traditional malware writes executable files to disk that antivirus can scan and signature-match. Fileless malware never creates a persistent file — it executes code directly in memory, often by abusing legitimate system tools ("living-off-the-land binaries" or LOLBins). A traditional ransomware infection drops files antivirus can identify; a fileless PowerShell attack uses Windows' own PowerShell engine to load malicious code from a remote URL into memory and execute it without ever writing to disk.
What is living-off-the-land (LOLBins)?
Living-off-the-land binaries are legitimate Windows tools that attackers abuse for malicious purposes — PowerShell, WMI (wmic.exe), certutil.exe, mshta.exe, rundll32.exe, regsvr32.exe, bitsadmin.exe, and others. These tools are signed by Microsoft, present on every Windows system, and have legitimate administrative uses. Attackers use them because their presence does not trigger antivirus signatures and their use is harder to distinguish from administrative activity. The LOLBAS project (lolbas-project.github.io) maintains a catalog of LOLBins and their abuse techniques.
How is fileless malware detected?
Detection requires behavioral monitoring rather than file scanning. EDR platforms (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) detect fileless attacks by observing process behavior — PowerShell spawning network connections to suspicious destinations, encoded command-line arguments, suspicious parent-child process relationships, and memory-based indicators of attack frameworks like Cobalt Strike. PowerShell logging (Module Logging, Script Block Logging, Transcription) provides the audit trail required to investigate fileless attacks post-execution.
Why is fileless malware difficult to remove?
The malware itself may disappear on reboot — but the persistence mechanism that re-establishes it after reboot often survives. Fileless attacks typically establish persistence through registry modifications, WMI event subscriptions, scheduled tasks, or service installations that re-launch the in-memory malware. Removing the malware requires identifying and removing the persistence mechanism, not just terminating the running process. EDR investigation capabilities are essential because forensic evidence is limited.
What was the most famous fileless attack?
NotPetya in 2017 used fileless techniques in its lateral movement phase, employing Mimikatz to extract credentials from LSASS memory and PsExec to execute on remote systems without dropping malware files. The attack caused over $10 billion in global damages, including $1.4 billion at Maersk alone. Equation Group's DoublePulsar and FuzzBunch tools, used in the 2017 ShadowBrokers leaks, were sophisticated fileless implants. More recently, the Lazarus Group's 3CX supply chain attack used fileless techniques to evade detection in compromised installations of legitimate VoIP software.
How can organizations defend against fileless malware?
EDR with behavioral detection is the primary technical control. PowerShell Constrained Language Mode restricts what PowerShell can do for non-administrators. Attack Surface Reduction rules in Microsoft Defender block specific LOLBin abuse patterns. AppLocker policies that restrict which scripts can execute. Comprehensive PowerShell logging enables post-incident investigation. The most important architectural defense is least-privilege — fileless attacks that succeed under standard user credentials cause limited damage; the same attacks under administrator credentials enable domain-wide compromise.
Real-World Example: Cobalt Strike — The Fileless Attack Standard
Cobalt Strike, a commercial penetration testing platform, has become the most widely used attack tool by ransomware operators and nation-state groups for post-exploitation operations. Cobalt Strike's Beacon payload is delivered through various initial access mechanisms and then operates entirely in memory, implementing virtually all major fileless attack techniques: process injection, reflective DLL loading, LOTL technique abuse, and encrypted C2 communications over legitimate protocols. Its prevalence across both criminal and nation-state operations makes behavioral detection for Cobalt Strike Beacon one of the most important capabilities for enterprise endpoint security products — and one that requires active behavioral rule development, not just signature updates.
Of successful breaches in 2024 involved fileless or living-off-the-land techniques at some stage of the attack — meaning organizations that rely primarily on signature-based file scanning miss the majority of modern attack activity.