<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-fileless-attack-techniques
description: >-
  Detect and analyze fileless malware, script-based attacks, LOLBin abuse,
  and memory-resident threats. Covers PowerShell logging, AMSI integration,
  ETW tracing, and behavioral detection rules for in-memory execution.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - fileless-malware
  - lolbins
  - powershell
  - amsi
  - memory-forensics
  - etw
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1059.001
    - T1218
    - T1055
    - T1027
    - T1140
---

# Detecting Fileless Attack Techniques

## Overview

Fileless attacks execute entirely in memory, leveraging legitimate system tools
(LOLBins) and scripting engines to avoid disk-based detection. Detection requires
enhanced logging (Script Block Logging, AMSI, ETW), behavioral analysis, and
memory inspection rather than traditional signature-based file scanning.

## Prerequisites

| Requirement | Purpose |
|---|---|
| PowerShell Script Block Logging | GPO-enabled deep script logging |
| AMSI providers | Anti-Malware Scan Interface integration |
| Sysmon | Process creation and script tracing (EID 1, 7, 8) |
| ETW providers | Event Tracing for Windows for .NET/PowerShell |
| Volatility 3 | Memory analysis for injected code detection |

## Workflow

1. **Enable logging** — Configure Script Block Logging, Module Logging, AMSI
2. **Deploy Sysmon** — Configure for process creation, image load, and CreateRemoteThread
3. **Baseline LOLBin usage** — Document legitimate uses of mshta, certutil, regsvr32, etc.
4. **Write detection rules** — Sigma rules for suspicious parent-child relationships
5. **Monitor AMSI events** — Alert on obfuscated script content flagged by AMSI
6. **Hunt for anomalies** — Stack count process trees, flag unusual LOLBin invocations
7. **Memory analysis** — Use Volatility to detect injected code in suspicious processes
8. **Update detections** — Refine rules based on hunting findings

## Key Commands

```powershell
# Enable PowerShell Script Block Logging
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" \
  -Name EnableScriptBlockLogging -Value 1 -PropertyType DWORD -Force

# Enable PowerShell Module Logging
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" \
  -Name EnableModuleLogging -Value 1 -PropertyType DWORD -Force

# Query for suspicious PowerShell execution
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational';Id=4104} |
  Where-Object { $_.Message -match 'downloadstring|invoke-expression|encodedcommand' }

# Detect LOLBin usage via Sysmon
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=1} |
  Where-Object { $_.Properties[4].Value -match 'mshta|certutil|regsvr32|rundll32' }

# Memory analysis for injected code
vol3 -f memory.raw windows.malfind
vol3 -f memory.raw windows.pslist --pid <pid>
```

## Verification

| Check | Method |
|---|---|
| Script Block Logging enabled | EID 4104 events present in PowerShell log |
| AMSI active | Test-AMSI triggers detection event |
| Sysmon capturing LOLBins | Sysmon EID 1 logs for mshta/certutil present |
| Detection rules firing | Test payload triggers Sigma rule alert |
| Memory analysis functional | `vol3 windows.malfind` completes without error |

## References

- [LOLBAS Project](https://lolbas-project.github.io/)
- [MITRE ATT&CK — Fileless](https://attack.mitre.org/techniques/T1059/001/)
- [PowerShell Logging Cheat Sheet](https://www.malwarearchaeology.com/cheat-sheets)

---
v1.0 | Validated: 2026-03-18
