Fileless Malware and Living-off-the-Land Attacks
Learn how fileless malware abuses legitimate tools (PowerShell, WMI, macros) to evade traditional signature-based detection.
Why Fileless Attacks Are So Effective
Traditional malware writes executable files to disk, giving signature-based antivirus an opportunity to scan and detect them. Fileless malware operates entirely in memory — or abuses legitimate tools already installed — leaving no traditional malware files for AV to find. This dramatically reduces detection rates against signature-based tools. Security vendors report that fileless malware attacks are 10x more likely to succeed than file-based attacks. The 2016 Bangladesh Bank heist, the 2017 Petya/NotPetya variants, and countless nation-state intrusions have leveraged fileless techniques to maintain persistence and evade detection.
Living-off-the-Land (LotL) Techniques
Living-off-the-land (LotL) attacks use legitimate tools and utilities already present on the victim system to carry out malicious actions. These tools — PowerShell, WMI, certutil, mshta, regsvr32, rundll32 — are trusted by OS and security software because they have legitimate purposes. An attacker who exclusively uses built-in tools can blend into normal administrative activity. The challenge for defenders is distinguishing malicious use of these tools from legitimate administrative work. This is why behavioral analytics and contextual awareness are more effective than signature detection for LotL techniques.
# Common LotL (LOLBins - Living Off the Land Binaries):
# certutil.exe - download files from internet
# mshta.exe - execute HTA (HTML Application) scripts
# regsvr32.exe - execute DLL or scriptlets remotely (Squiblydoo)
# rundll32.exe - execute DLL exports
# wmic.exe - WMI queries and lateral movement
# bitsadmin.exe - download/upload via BITS service
# powershell.exe - nearly unlimited capability
# cmstp.exe - bypass UAC, run scriptsAll lessons in this course
- Viruses, Worms, and Trojans
- Ransomware and Cryptolockers
- Rootkits, Spyware, and Keyloggers
- Fileless Malware and Living-off-the-Land Attacks