<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Fileless Malware — API Reference

## Volatility 3 — Memory Forensics

### Fileless-Relevant Plugins

```bash
# Detect injected code in process memory
vol3 -f memory.dmp windows.malfind

# List running processes with parent relationships
vol3 -f memory.dmp windows.pstree

# Dump process memory for YARA scanning
vol3 -f memory.dmp windows.pslist --dump --pid 1234

# List loaded DLLs (detect reflective loading)
vol3 -f memory.dmp windows.dlllist --pid 1234

# Network connections from memory
vol3 -f memory.dmp windows.netscan
```

## PowerShell Logging

### Script Block Logging (Event ID 4104)

```powershell
# Enable via GPO or registry
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
    -Name "EnableScriptBlockLogging" -Value 1

# Query logs
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" `
    -FilterXPath "*[System[EventID=4104]]" -MaxEvents 100
```

### Module Logging (Event ID 4103)

```powershell
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" `
    -Name "EnableModuleLogging" -Value 1
```

## Sysmon

### Relevant Event IDs

| Event ID | Description |
|----------|-------------|
| 1 | Process creation with command line |
| 7 | Image loaded (DLL) |
| 8 | CreateRemoteThread |
| 19-21 | WMI event filter/consumer/binding |

### Config Example

```xml
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <ProcessCreate onmatch="include">
      <ParentImage condition="end with">powershell.exe</ParentImage>
    </ProcessCreate>
    <WmiEvent onmatch="include"/>
  </EventFiltering>
</Sysmon>
```

## ETW Providers

| Provider | GUID | Purpose |
|----------|------|---------|
| Microsoft-Windows-PowerShell | `{A0C1853B-5C40-4B15-8766-3CF1C58F985A}` | PS execution |
| Microsoft-Windows-DotNETRuntime | `{E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4}` | .NET loading |
| Microsoft-Windows-WMI-Activity | `{1418EF04-B0B4-4623-BF7E-D74AB47BBDAA}` | WMI operations |

## AMSI (Antimalware Scan Interface)

```powershell
# Check AMSI status
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')

# AMSI bypasses to detect (in logs):
# - amsiInitFailed forced to True
# - AmsiScanBuffer patched in memory
# - AMSI DLL unhooking
```
