Fileless malware

Description

It arrives through macros, vulnerabilities or stolen access; instead of dropping its own program onto the machine it uses what the system already provides. It hangs its execution on scheduled tasks and the Windows registry — again with no conspicuous file. A restart clears it from memory, but persistence techniques bring it back.

Protection that looks for a malicious file with a signature has nothing to find here. The defense has to follow what is happening rather than what is lying on disk: legitimate tools behaving unusually, scripts running where they have no business, odd repeating executions and scheduled tasks. Without behavioral monitoring, this malware slips under the radar.

Examples

• A macro in a document starts PowerShell, and the rest is done from RAM; there is nothing on disk to detect and delete.
• Through a stolen account the attacker has access to most of the tools in the operating system. If they are skilled enough, or working from clear instructions, the changes are hard to spot.
• A scheduled task starts a process in memory every morning, through which the attacker connects and widens their presence.

Notes

• Protection that only guards against malicious files on disk cannot detect fileless malware.
• Why is this task running, and what does this script do — those are the first real questions when dealing with fileless malware.