Fileless malware is malicious code that runs in memory or hides inside legitimate system components instead of saving a traditional executable file to disk.
How fileless malware works
Classic malware drops an .exe file that antivirus can scan. Fileless attacks avoid this. Typical techniques:
- running scripts directly in memory with PowerShell, WMI, mshta or rundll32;
- injecting code into the memory of legitimate processes;
- storing encrypted payloads in the Windows registry or WMI event subscriptions instead of files;
- using macros or exploits that download and execute code without writing it to disk.
Persistence is achieved through registry Run keys, scheduled tasks or WMI subscriptions that re-launch the in-memory code after reboot. Early examples such as Poweliks and Kovter hid their entire body in the registry. Many modern intrusions are “fileless” in practice because attackers use only built-in tools – a technique known as living off the land.
Why it matters
With no file to scan, signature-based tools have little to detect, and forensic traces disappear after a reboot. The activity is carried out by trusted Microsoft-signed binaries, which blends in with normal administration. This makes fileless techniques popular with both APT groups and ransomware affiliates.
How to detect and prevent
- Use EDR with memory scanning and behavioural detection.
- Enable PowerShell script-block logging, AMSI and command-line auditing.
- Restrict PowerShell with Constrained Language Mode and application control (WDAC, AppLocker).
- Disable Office macros from the internet and keep systems patched.
