Technique
№ 014 · class: execution
In-Memory Execution
Executing malicious code in memory without writing files to disk.
Term
description · examples · notesExecuting malicious code in memory without writing files to disk.
Description
Uses PowerShell, WMI, VBScript, or .NET reflection for execution.
Bypasses antivirus scanners that check files on disk.
Memory traces disappear after system restart.
Requires EDR with process behavior monitoring for detection.
Examples
- PowerShell download cradle — download and execute in memory
- WMI eventing for persistent fileless execution
Notes
- Execution technique for fileless-malware threat.
Mentioned in the news
Threats
used by 4Threats that use it. Select one to open its page.
Defenses
countered by 6How it is countered. Select one to open its page.