detecting-fileless-attacks-on-endpoints

name	detecting-fileless-attacks-on-endpoints
description	Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","fileless-malware","memory-attacks","PowerShell","detection-engineering"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Detecting Fileless Attacks on Endpoints

When to Use

Use this skill when:

• Building detection rules for fileless malware that operates entirely in memory
• Hunting for PowerShell-based attacks, reflective DLL injection, and WMI abuse
• Configuring endpoint telemetry (Sysmon, AMSI, PowerShell logging) to capture fileless indicators
• Investigating incidents where traditional AV found no malicious files

Do not use for detecting file-based malware or for malware reverse engineering.

Detection Gaps & Validation

• PowerShell logging declared but not capturing: Script Block (4104) and Module Logging must be set machine-wide (HKLM, not HKCU) and apply to PowerShell v5+; a v2 downgrade (powershell -version 2) evades 4104 entirely. Confirm 4104 text is present for a known script before trusting a clean result.
• AMSI/ETW bypass blinds content inspection: in-memory amsi.dll patches and ETW patching suppress AMSI and 4104 events. Detect the bypass itself — 4104 containing AmsiUtils/amsiInitFailed/[Ref].Assembly.GetType — and treat an abrupt halt in script-block events as suspicious.
• Reflective/in-memory loads leave no disk artifact: rely on Sysmon EID 7 (ImageLoaded from non-standard paths), EID 8 (CreateRemoteThread), and EID 10 (ProcessAccess to lsass 0x1010); direct-syscall loaders may bypass EID 8, so back them with MDE CreateRemoteThreadApiCall/NtAllocateVirtualMemoryApiCall.
• WMI persistence missed when 19/20/21 are off: many Sysmon configs omit WmiEvent logging. Confirm EID 19-21 are enabled and that __FilterToConsumerBinding enumeration runs.
• Validate each detection: run Atomic Red Team T1059.001 (encoded PowerShell / download cradle), T1620 (reflective load), and T1546.003 (WMI event subscription) and confirm 4104, Sysmon 7/8, and 19-21 events reach the SIEM. Tune encoded-command false positives against known admin tooling instead of dropping the rule.

Prerequisites

• Sysmon with process creation and WMI event logging enabled
• PowerShell Script Block Logging and Module Logging enabled
• AMSI (Antimalware Scan Interface) enabled for script content inspection
• EDR with behavioral detection capabilities (MDE, CrowdStrike, SentinelOne)

Workflow

Step 1: Enable Required Telemetry

# Enable PowerShell Script Block Logging (GPO or registry)
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
  -Name EnableScriptBlockLogging -Value 1 -PropertyType DWORD -Force

# Enable PowerShell Module Logging
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" `
  -Name EnableModuleLogging -Value 1 -PropertyType DWORD -Force

# Enable PowerShell Transcription
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" `
  -Name EnableTranscripting -Value 1 -PropertyType DWORD -Force

# Sysmon config for fileless detection (key events):
# Event ID 1: Process creation (captures CommandLine)
# Event ID 7: Image loaded (DLL loading)
# Event ID 8: CreateRemoteThread (injection)
# Event ID 10: Process access (LSASS access)
# Event ID 19/20/21: WMI events