<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Fileless Attack Techniques

## Fileless Detection APIs

### Windows Event Log Queries

| Event Source | Event ID | Description |
|---|---|---|
| PowerShell Operational | 4104 | Script Block Logging — full script content |
| PowerShell Operational | 4103 | Module Logging — pipeline execution details |
| Sysmon | 1 | Process creation with command line |
| Sysmon | 7 | Image loaded — DLL injection detection |
| Sysmon | 8 | CreateRemoteThread — process injection |
| Sysmon | 10 | ProcessAccess — credential dumping |
| Windows Defender | 1116 | AMSI detection event |

### Volatility 3 Commands

| Command | Description |
|---|---|
| `vol3 windows.malfind` | Detect injected code in process memory |
| `vol3 windows.pslist` | List running processes from memory |
| `vol3 windows.cmdline` | Extract process command lines |
| `vol3 windows.netscan` | Network connections from memory |

### Agent Script

```bash
# Check Script Block Logging
node agent.js check-logging

# Scan for LOLBin processes
node agent.js scan-lolbins

# Check AMSI providers
node agent.js check-amsi
```
