Fileless Malware and Living-in-Memory Techniques

Fileless malware executes entirely in memory without writing executable files to disk. It leverages legitimate OS tools, interpreter environments (PowerShell, WScript), and in-memory injection to operate while leaving minimal forensic artifacts detectable by traditional AV and file-based scanning.

PowerShell enables download-and-execute patterns: IEX (Invoke-Expression) downloads and runs scripts directly from the internet without touching disk. Obfuscation techniques (character replacement, base64, string concatenation) bypass signature-based detection of malicious script content.

LOLBins are legitimate Windows binaries that can be weaponized: certutil.exe (download files), mshta.exe (execute HTA scripts), regsvr32.exe (execute remote COM objects), wmic.exe (execute commands), and PowerShell (everything). They are pre-installed, signed, and often whitelisted.

Classic injection: VirtualAllocEx → WriteProcessMemory → CreateRemoteThread. Process hollowing: launch a suspended legitimate process, unmap its code, and replace with malicious code. DLL injection via SetWindowsHookEx or AppInit_DLLs. All run malicious code inside trusted processes.

Reflective DLL injection loads a DLL from memory without using the Windows loader or touching disk. The DLL contains its own mini-loader that resolves imports and relocates itself. Meterpreter uses reflective loading, which is why it leaves no DLL file on disk.

Process hollowing creates a legitimate process (svchost.exe) in suspended state, unmaps its original executable from memory, maps a malicious executable into the same address space, then resumes execution. The process appears legitimate in task manager but runs malicious code.

Microsoft's Antimalware Scan Interface (AMSI) intercepts PowerShell scripts for AV scanning. Attackers bypass AMSI by patching AmsiScanBuffer() in memory to always return a clean result, or by obfuscating scripts below AMSI detection thresholds. AMSI patching is itself detectable by EDR.

Fileless malware is detected through behavior, not file presence: PowerShell spawning network connections, unexpected child processes of Office applications, memory regions with executable permissions but no backing file (malfind), and LOLBin command-line arguments containing encoded content.

Windows Event Tracing (ETW) provides rich telemetry for EDR platforms: Script Block Logging captures decoded PowerShell, Module Logging records DLLs loaded, process creation with full command lines, and network connection events. ETW providers are difficult for malware to disable without triggering alerts.

Volatility malfind identifies suspicious executable memory regions. Strings in process memory may reveal C2 URLs or embedded scripts. Process hollowing leaves the original process image unmapped — detectable by comparing the process memory map to the original executable on disk.

Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging to capture all decoded script content. PowerShell Constrained Language Mode restricts dangerous operations. WDAC application whitelisting prevents unapproved LOLBin combinations from executing malicious scripts.

What makes fileless malware harder to detect than traditional malware?

Fileless malware abuses PowerShell, LOLBins, and process injection to execute entirely in memory. Defending against it requires Script Block Logging, behavioral analytics from EDR platforms, AMSI enforcement, application whitelisting, and memory forensics tools like Volatility to identify injected code.