malware-technique-fileless

| | Fileless Malware | Malware operating entirely in memory or within legitimate system tools without creating traditional executable files on disk | | LOLBins (Living Off the Land Binaries) | Legitimate system binaries (mshta, regsvr32, certutil) abused by attackers to execute malicious code while evading application whitelisting | | WMI Event Subscription | Windows Management Instrumentation persistence mechanism using event filters, consumers, and bindings to execute code on system events | | Registry-Resident Payload | Malicious code stored as encoded data in Windows Registry values, loaded and executed by a small stub in a Run key | | Reflective Loading | Loading .NET assemblies or PE files from byte arrays in memory using Assembly.Load() without writing to disk | | In-Memory Execution | Running code directly in RAM without creating files, leveraging process injection, reflective loading, or script interpreters | | Script Block Logging | Windows PowerShell logging feature (Event ID 4104) that captures script content after deobfuscation, essential for fileless threat visibility |

Tools & Systems

• Sysmon: System Monitor providing detailed event logging for process creation, WMI events, registry changes, and network connections
• Autoruns: Sysinternals tool showing all auto-start locations including WMI subscriptions, scheduled tasks, and registry entries
• Volatility: Memory forensics framework for detecting in-memory code, injected processes, and fileless malware artifacts
• Process Monitor: Real-time monitoring of file system, registry, and process activity for observing fileless attack behavior
• LOLBAS Project: Community-documented catalog of LOLBin abuse techniques at https://lolbas-project.github.io/

Common Scenarios

Scenario: Investigating a Fileless Attack Using WMI Persistence

Context: Sysmon alerts show WMI event subscription creation followed by periodic PowerShell execution without any corresponding malware files on disk. The attack persists across reboots.

Approach:

1. Query WMI namespace for event filters, consumers, and bindings to identify the persistence mechanism
2. Extract the CommandLineEventConsumer or ActiveScriptEventConsumer payload
3. Decode the PowerShell command (typically Base64-encoded with -enc flag)
4. Trace the PowerShell execution in Script Block Logging (Event ID 4104) for the full deobfuscated payload
5. Analyze memory dump for reflectively loaded assemblies and injected code
6. Check registry for additional stored payloads referenced by the PowerShell script
7. Map the complete attack chain from initial access through persistence and lateral movement

Pitfalls:

• Not having Sysmon WMI event logging enabled (Events 19/20/21) before the incident
• Rebooting the system before capturing a memory dump (destroys in-memory evidence)
• Focusing only on file-based IOCs when the attack is entirely fileless
• Missing the initial access vector because the LOLBin execution left minimal traces

Output Format

FILELESS MALWARE ANALYSIS REPORT
===================================
Incident:         INC-2025-2847
Attack Type:      Fileless (no malware files on disk)

INITIAL ACCESS
Vector:           Phishing email with macro-enabled document
LOLBin Chain:     WINWORD.EXE -> mshta.exe -> powershell.exe

PERSISTENCE MECHANISM
Type:             WMI Event Subscription
Filter Name:      WindowsUpdateCheck
Filter Query:     SELECT * FROM __InstanceModificationEvent WITHIN 300
                  WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'
Consumer:         CommandLineEventConsumer
Command:          powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...

DECODED PAYLOAD
[Layer 1] Base64 UTF-16LE decode
[Layer 2] AMSI bypass + Assembly.Load() of embedded .NET payload
[Layer 3] .NET RAT with C2 communication to 185.220.101[.]42

REGISTRY PAYLOADS
HKCU\Software\AppDataLow\Config\data = [Base64 encoded .NET assembly, 247KB]
Loaded by: PowerShell WMI consumer script

MEMORY ARTIFACTS
PID 4012 (powershell.exe): Injected .NET assembly at 0x00400000
  - CobaltStrike beacon detected via YARA
  - C2: hxxps://185.220.101[.]42/updates

EXTRACTED IOCs
C2 IP:            185.220.101[.]42
WMI Filter:       WindowsUpdateCheck
Registry Path:    HKCU\Software\AppDataLow\Config\data
PowerShell Flags: -nop -w hidden -enc

MITRE ATT&CK
T1059.001  PowerShell
T1546.003  WMI Event Subscription
T1218.005  Mshta
T1112      Modify Registry
T1055.012  Process Hollowing