Fileless malware
noun
Malicious code that runs in memory or through legitimate tools like PowerShell, leaving few or no malicious files on disk to scan.
Traditional antivirus works by inspecting files. Fileless malware avoids leaving a malicious file to inspect. Instead, it runs code directly in memory, injects it into legitimate processes, or uses tools already on the system, such as PowerShell, WMI or the .NET runtime, to load its payload. When it needs to survive a reboot, it may store its code in the registry or in a WMI event subscription rather than in an executable file.
The term is a little misleading: most attacks still involve some file at some point, such as a malicious document or a shortcut. What matters is that the main payload never lands on disk in a form a scanner can easily catch, which makes fileless techniques a close relative of living off the land.
Example
A user opens an attachment that runs a short command. The command starts PowerShell with an encoded script that downloads the next stage straight into memory and runs it there. A file scan of the computer afterwards finds nothing, but the attacker has a working backdoor.
Why it matters for a SOC analyst
Fileless attacks are caught by watching behavior, not files: process trees, command lines and memory. Enable PowerShell script block logging (event 4104) and make sure the Antimalware Scan Interface (AMSI) is not disabled, since both let you see scripts after they are decoded. In EDR data, an Office application or browser starting PowerShell with an encoded command is a classic signal.
Related terms
- Living off the land
Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Threat hunting
The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.