<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-fileless-malware
description: >-
  Detect and analyze fileless malware that resides exclusively in memory, abuses
  legitimate system tools (PowerShell, WMI, .NET), and leaves minimal disk artifacts.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - fileless-malware
  - powershell
  - wmi
  - memory-analysis
  - living-off-the-land
  - process-injection
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.001", "T1055"]
---

# Detecting Fileless Malware

## Overview

Fileless malware operates entirely in memory or abuses trusted system binaries to execute malicious logic without writing traditional executables to disk. Attack vectors include PowerShell cradles, WMI event subscriptions, .NET assembly reflection loading, and registry-resident payloads. Detection requires memory forensics, ETW tracing, script block logging analysis, and behavioral heuristics rather than file-based scanning.

## Prerequisites

- Volatility 3 for memory forensics
- PowerShell Script Block Logging enabled (GPO: `EnableScriptBlockLogging`)
- Sysmon with process creation and WMI event logging
- AMSI integration for real-time script inspection
- ETW consumer for `Microsoft-Windows-PowerShell` provider
- YARA with process memory scanning capability

## Key Concepts

### Fileless Attack Categories

| Category | Technique | Persistence |
|----------|-----------|-------------|
| Type I — No file activity | Memory-only shellcode injection | None (volatile) |
| Type II — Indirect file activity | Registry payload, WMI subscription | Registry/WMI store |
| Type III — Files required for operation | Malicious scripts, .lnk launchers | Script files on disk |

### Common Fileless Vectors

- **PowerShell cradles**: `IEX(New-Object Net.WebClient).DownloadString('http://...')`
- **WMI persistence**: `__EventFilter` + `__EventConsumer` + `__FilterToConsumerBinding`
- **Registry payloads**: Shellcode stored in `HKLM\SOFTWARE` values, loaded by RunKey
- **.NET reflection**: `[System.Reflection.Assembly]::Load($bytes)` in memory

## Workflow

### Step 1: Detect Suspicious PowerShell Activity

```bash
# Parse PowerShell Script Block Logs (Event ID 4104)
# Windows Event Log path: Microsoft-Windows-PowerShell/Operational
wevtutil qe "Microsoft-Windows-PowerShell/Operational" /q:"*[System[EventID=4104]]" /f:text /c:50

# Look for encoded command execution
grep -iE "encodedcommand|-enc|-ec " /var/log/sysmon/events.json

# YARA rule for PowerShell cradle patterns
yara -s powershell_cradles.yar /var/log/scriptblock/
```

### Step 2: Enumerate WMI Persistence

```powershell
# List WMI event subscriptions (common fileless persistence)
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

# Autoruns check for WMI entries
autorunsc.exe -m -nobanner -accepteula
```

### Step 3: Memory Analysis with Volatility

```bash
# Scan for injected code in processes
vol3 -f memory.dmp windows.malfind

# Detect hollowed processes
vol3 -f memory.dmp windows.pslist --dump
vol3 -f memory.dmp windows.vadinfo --pid 1234

# Extract .NET assemblies loaded via reflection
vol3 -f memory.dmp windows.netscan

# List loaded modules — compare against known-good baseline
vol3 -f memory.dmp windows.dlllist --pid 1234
```

### Step 4: Analyze ETW Traces

```powershell
# Start ETW trace for PowerShell and .NET
logman create trace FilelessHunt -p Microsoft-Windows-PowerShell 0xFFFF -ets
logman create trace DotNetHunt -p Microsoft-Windows-DotNETRuntime 0x2038 -ets

# Collect for analysis period, then stop
logman stop FilelessHunt -ets
logman stop DotNetHunt -ets
```

### Step 5: Registry Payload Detection

```bash
# Scan registry for high-entropy values (encoded payloads)
python3 -c "
import winreg
import math

def entropy(data: bytes) -> float:
    if not data:
        return 0.0
    freq = [0] * 256
    for b in data:
        freq[b] += 1
    length = len(data)
    return -sum((f/length) * math.log2(f/length) for f in freq if f > 0)

# Check common payload locations
keys = [
    (winreg.HKEY_CURRENT_USER, r'Software'),
    (winreg.HKEY_LOCAL_MACHINE, r'SOFTWARE'),
]
for hive, path in keys:
    try:
        key = winreg.OpenKey(hive, path)
        for i in range(winreg.QueryInfoKey(key)[1]):
            name, data, _ = winreg.EnumValue(key, i)
            if isinstance(data, bytes) and len(data) > 500:
                e = entropy(data)
                if e > 6.5:
                    print(f'⚠ High entropy registry value: {path}\\\\{name} entropy={e:.2f} size={len(data)}')
    except OSError:
        pass
"
```

## YARA Rule

```yara
rule Fileless_PowerShell_Cradle {
    meta:
        description = "Detects PowerShell download cradle patterns in script logs"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1059.001"
        severity = "high"
    strings:
        $cradle1 = "New-Object Net.WebClient" ascii nocase
        $cradle2 = "DownloadString" ascii nocase
        $cradle3 = "IEX" ascii nocase
        $cradle4 = "Invoke-Expression" ascii nocase
        $enc1 = "-EncodedCommand" ascii nocase
        $enc2 = "[Convert]::FromBase64String" ascii nocase
        $refl = "[Reflection.Assembly]::Load" ascii nocase
    condition:
        (($cradle1 and $cradle2) and ($cradle3 or $cradle4)) or
        ($enc1 and $enc2) or
        $refl
}
```

## Detection

```yaml
title: Fileless Malware Detection
id: 22a6272f-3405-405c-b74c-eed3fe96af29
status: experimental
description: Detects suspicious activity related to detecting fileless malware techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*fileless*"
  condition: selection
level: high
tags:
  - attack.t1059.001
  - attack.t1055
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] PowerShell Script Block Logging analyzed for suspicious patterns
- [ ] WMI event subscriptions enumerated and validated
- [ ] Memory dump analyzed with Volatility for injected code
- [ ] Registry scanned for high-entropy payload values
- [ ] ETW traces collected and parsed for .NET reflection loading
- [ ] YARA rules deployed for fileless indicator detection
- [ ] IOCs mapped to MITRE ATT&CK (T1059.001, T1546.003, T1547.001)

## References

- [MITRE ATT&CK T1059.001 — PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1546.003 — WMI Event Subscription](https://attack.mitre.org/techniques/T1546/003/)
- [Volatility 3 Framework](https://github.com/volatilityfoundation/volatility3)
- [Microsoft AMSI Documentation](https://docs.microsoft.com/en-us/windows/win32/amsi/)
