Fileless Malware and Living-off-the-Land Attacks

Traditional malware writes executable files to disk, giving signature-based antivirus an opportunity to scan and detect them. Fileless malware operates entirely in memory — or abuses legitimate tools already installed — leaving no traditional malware files for AV to find. This dramatically reduces detection rates against signature-based tools. Security vendors report that fileless malware attacks are 10x more likely to succeed than file-based attacks. The 2016 Bangladesh Bank heist, the 2017 Petya/NotPetya variants, and countless nation-state intrusions have leveraged fileless techniques to maintain persistence and evade detection.

Living-off-the-land (LotL) attacks use legitimate tools and utilities already present on the victim system to carry out malicious actions. These tools — PowerShell, WMI, certutil, mshta, regsvr32, rundll32 — are trusted by OS and security software because they have legitimate purposes. An attacker who exclusively uses built-in tools can blend into normal administrative activity. The challenge for defenders is distinguishing malicious use of these tools from legitimate administrative work. This is why behavioral analytics and contextual awareness are more effective than signature detection for LotL techniques.

PowerShell is the most abused LotL tool because it provides access to the full .NET framework, WMI, and Windows APIs with minimal trace when executed in memory. Attackers download PowerShell scripts directly into memory without writing to disk, encode commands in Base64 to obfuscate them from logging, and use features like reflection to load .NET assemblies in memory. The Empire and Cobalt Strike frameworks rely heavily on PowerShell for post-exploitation. Defenses include PowerShell Constrained Language Mode, ScriptBlock Logging (logs decoded script content), Module Logging, and restricting who can run PowerShell via Group Policy.

WMI (Windows Management Instrumentation) is a powerful Windows feature for system management that attackers abuse for persistence and lateral movement. A WMI event subscription triggers a command when a specified event occurs (such as every 5 minutes, at logon, or when a specific process starts). These subscriptions survive reboots, are stored in the WMI repository, and do not appear as traditional scheduled tasks or registry run keys — evading many persistence detection tools. Attackers can also use WMI to execute processes on remote systems over DCOM (port 135), enabling lateral movement without network shares.

Process injection allows malware to run malicious code inside the address space of a legitimate, trusted process (explorer.exe, svchost.exe, notepad.exe). The malicious code inherits the process's privileges and identity, making network connections appear to come from a trusted application. Common injection techniques include DLL injection (loading a malicious DLL into another process), process hollowing (creating a suspended process, unmapping its code, and replacing it with malicious code), and reflective DLL injection (loading a DLL directly from memory without writing to disk). EDR tools detect injection by monitoring API call sequences (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).

Many fileless attack chains begin with a malicious Office document containing VBA macros. When the user opens the document and enables macros (often lured by a message like 'Enable Content to view this document'), the macro runs PowerShell to download and execute a payload directly in memory. The payload never touches disk — only the original Office document does. This is why the Security+ exam emphasizes disabling macros and deploying ASR (Attack Surface Reduction) rules. Modern attacker-in-the-middle phishing frameworks (like Evilginx2) also deliver malicious documents after credential capture to deploy RATs.

AMSI (Antimalware Scan Interface) is a Windows API that enables applications (PowerShell, VBScript, JScript, Office) to submit content to the installed antivirus engine for scanning at runtime — even before the content is written to disk. AMSI allows AV vendors to scan script content that would otherwise be invisible to file-based scanning. Attackers attempt to bypass AMSI by patching the amsi.dll in memory to return a result of 'clean' for all submissions, or by obfuscating script content to evade signature matching. EDR tools monitor for AMSI patching attempts as an indicator of fileless attack activity.

Detecting fileless malware requires shifting from file-based detection to behavioral monitoring. Key detection strategies include: PowerShell ScriptBlock Logging captures decoded script content even if encoded on the command line; Sysmon logs process creation with full command lines, network connections with process attribution, and registry modifications; EDR behavioral rules alert on suspicious process relationships (Word spawning PowerShell, PowerShell spawning cmd, certutil downloading executables); and Windows Event Forwarding sends these logs to a centralized SIEM for correlation and long-term retention.

Organizations can reduce LotL attack surface by restricting which users can run powerful tools. PowerShell Constrained Language Mode limits .NET calls, COM objects, and reflection that attackers rely on. AppLocker and WDAC (Windows Defender Application Control) can prevent specific binaries from running for non-admin users. The LOLBAS project catalogs known LotL binaries with their attack techniques, helping defenders identify which binaries to monitor or restrict. Not all LotL binaries can be blocked (many are required for OS function), but monitoring their usage with context is achievable.

The MITRE ATT&CK framework documents fileless and LotL techniques extensively. Key sub-techniques include: T1059.001 (PowerShell), T1047 (WMI execution), T1055 (Process Injection), T1140 (Deobfuscate/Decode Files), T1003.001 (LSASS Memory for credential dumping), and T1546.003 (WMI Event Subscription for persistence). Mapping your detection capabilities to these techniques using ATT&CK Navigator reveals coverage gaps and guides SIEM rule development. The framework also provides mitigation and detection guidance for each technique.

A layered defense strategy for fileless malware includes: enabling PowerShell logging (ScriptBlock, Module, Transcription), deploying Sysmon with a comprehensive configuration, implementing AMSI with an updated AV engine, enforcing PowerShell Constrained Language Mode via WDAC, restricting macro execution in Office documents via Group Policy, deploying EDR with behavioral detection capabilities, and forwarding all logs to a SIEM with detection rules for known-bad process chains. The combination of restricting attack surface and improving visibility makes fileless attacks significantly harder to execute without detection.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: fileless malware operates in memory and abuses legitimate OS tools like PowerShell, WMI, and certutil to evade signature-based detection, process injection techniques hide malicious code inside trusted processes by exploiting Windows memory management APIs, and behavioral detection via SIEM, Sysmon, and EDR combined with PowerShell logging and AMSI provides the strongest defense against these signature-evading attack chains. Next up we explore vulnerability scanning versus penetration testing.