What is fileless malware?
D2 · Threats · CompTIA Security+ SY0-701Fileless malware operates entirely in memory (RAM) without writing malicious files to disk. It hijacks legitimate system processes and tools (PowerShell, WMI, cmd.exe) — a technique called living off the land (LOtL) — making it nearly invisible to traditional file-based AV.
Delivery: often through phishing → malicious macro → PowerShell payload executed in memory.
Persistence mechanisms: registry entries, scheduled tasks, WMI subscriptions — all pointing to scripts, not files.
Delivery: often through phishing → malicious macro → PowerShell payload executed in memory.
Persistence mechanisms: registry entries, scheduled tasks, WMI subscriptions — all pointing to scripts, not files.
Fileless malware evades signature-based AV because there's no file to scan. Behavioral detection (EDR) is essential. Look for unusual PowerShell activity, WMI event subscriptions, and processes spawning from Office applications. Memory forensics (Volatility) can detect active fileless threats.