[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F2EEM1FNS4FAAZTHN8CCR":3,"skill-same:01M71F2EEM1FNS4FAAZTHN8CCR":55},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":26,"frontMatter":27,"refName":28,"commitSha":29,"skillDirectory":30,"forksCount":14,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M71F2EEM1FNS4FAAZTHN8CCR","malware-technique-fileless",null,"Malware Technique Fileless.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-technique-fileless\u002FSKILL.md",[],[19,20,21,22],"malware","fileless","malware technique fileless","cybersecurity","2026-11-10 10:12:30",false,"---\nname: malware-technique-fileless\ndescription: \"Malware Technique Fileless.\"\ndomain: cybersecurity\n---\n\n|\n| **Fileless Malware** | Malware operating entirely in memory or within legitimate system tools without creating traditional executable files on disk |\n| **LOLBins (Living Off the Land Binaries)** | Legitimate system binaries (mshta, regsvr32, certutil) abused by attackers to execute malicious code while evading application whitelisting |\n| **WMI Event Subscription** | Windows Management Instrumentation persistence mechanism using event filters, consumers, and bindings to execute code on system events |\n| **Registry-Resident Payload** | Malicious code stored as encoded data in Windows Registry values, loaded and executed by a small stub in a Run key |\n| **Reflective Loading** | Loading .NET assemblies or PE files from byte arrays in memory using Assembly.Load() without writing to disk |\n| **In-Memory Execution** | Running code directly in RAM without creating files, leveraging process injection, reflective loading, or script interpreters |\n| **Script Block Logging** | Windows PowerShell logging feature (Event ID 4104) that captures script content after deobfuscation, essential for fileless threat visibility |\n\n## Tools & Systems\n\n- **Sysmon**: System Monitor providing detailed event logging for process creation, WMI events, registry changes, and network connections\n- **Autoruns**: Sysinternals tool showing all auto-start locations including WMI subscriptions, scheduled tasks, and registry entries\n- **Volatility**: Memory forensics framework for detecting in-memory code, injected processes, and fileless malware artifacts\n- **Process Monitor**: Real-time monitoring of file system, registry, and process activity for observing fileless attack behavior\n- **LOLBAS Project**: Community-documented catalog of LOLBin abuse techniques at https:\u002F\u002Flolbas-project.github.io\u002F\n\n## Common Scenarios\n\n### Scenario: Investigating a Fileless Attack Using WMI Persistence\n\n**Context**: Sysmon alerts show WMI event subscription creation followed by periodic PowerShell execution without any corresponding malware files on disk. The attack persists across reboots.\n\n**Approach**:\n1. Query WMI namespace for event filters, consumers, and bindings to identify the persistence mechanism\n2. Extract the CommandLineEventConsumer or ActiveScriptEventConsumer payload\n3. Decode the PowerShell command (typically Base64-encoded with -enc flag)\n4. Trace the PowerShell execution in Script Block Logging (Event ID 4104) for the full deobfuscated payload\n5. Analyze memory dump for reflectively loaded assemblies and injected code\n6. Check registry for additional stored payloads referenced by the PowerShell script\n7. Map the complete attack chain from initial access through persistence and lateral movement\n\n**Pitfalls**:\n- Not having Sysmon WMI event logging enabled (Events 19\u002F20\u002F21) before the incident\n- Rebooting the system before capturing a memory dump (destroys in-memory evidence)\n- Focusing only on file-based IOCs when the attack is entirely fileless\n- Missing the initial access vector because the LOLBin execution left minimal traces\n\n## Output Format\n\n```\nFILELESS MALWARE ANALYSIS REPORT\n===================================\nIncident:         INC-2025-2847\nAttack Type:      Fileless (no malware files on disk)\n\nINITIAL ACCESS\nVector:           Phishing email with macro-enabled document\nLOLBin Chain:     WINWORD.EXE -> mshta.exe -> powershell.exe\n\nPERSISTENCE MECHANISM\nType:             WMI Event Subscription\nFilter Name:      WindowsUpdateCheck\nFilter Query:     SELECT * FROM __InstanceModificationEvent WITHIN 300\n                  WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\nConsumer:         CommandLineEventConsumer\nCommand:          powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...\n\nDECODED PAYLOAD\n[Layer 1] Base64 UTF-16LE decode\n[Layer 2] AMSI bypass + Assembly.Load() of embedded .NET payload\n[Layer 3] .NET RAT with C2 communication to 185.220.101[.]42\n\nREGISTRY PAYLOADS\nHKCU\\Software\\AppDataLow\\Config\\data = [Base64 encoded .NET assembly, 247KB]\nLoaded by: PowerShell WMI consumer script\n\nMEMORY ARTIFACTS\nPID 4012 (powershell.exe): Injected .NET assembly at 0x00400000\n  - CobaltStrike beacon detected via YARA\n  - C2: hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\n\nEXTRACTED IOCs\nC2 IP:            185.220.101[.]42\nWMI Filter:       WindowsUpdateCheck\nRegistry Path:    HKCU\\Software\\AppDataLow\\Config\\data\nPowerShell Flags: -nop -w hidden -enc\n\nMITRE ATT&CK\nT1059.001  PowerShell\nT1546.003  WMI Event Subscription\nT1218.005  Mshta\nT1112      Modify Registry\nT1055.012  Process Hollowing\n```\n","|\n| **Fileless Malware** | Malware operating entirely in memory or within legitimate system tools without creating traditional executable files on disk |\n| **LOLBins (Living Off the Land Binaries)** | Legitimate system binaries (mshta, regsvr32, certutil) abused by attackers to execute malicious code while evading application whitelisting |\n| **WMI Event Subscription** | Windows Management Instrumentation persistence mechanism using event filters, consumers, and bindings to execute code on system events |\n| **Registry-Resident Payload** | Malicious code stored as encoded data in Windows Registry values, loaded and executed by a small stub in a Run key |\n| **Reflective Loading** | Loading .NET assemblies or PE files from byte arrays in memory using Assembly.Load() without writing to disk |\n| **In-Memory Execution** | Running code directly in RAM without creating files, leveraging process injection, reflective loading, or script interpreters |\n| **Script Block Logging** | Windows PowerShell logging feature (Event ID 4104) that captures script content after deobfuscation, essential for fileless threat visibility |\n\n## Tools & Systems\n\n- **Sysmon**: System Monitor providing detailed event logging for process creation, WMI events, registry changes, and network connections\n- **Autoruns**: Sysinternals tool showing all auto-start locations including WMI subscriptions, scheduled tasks, and registry entries\n- **Volatility**: Memory forensics framework for detecting in-memory code, injected processes, and fileless malware artifacts\n- **Process Monitor**: Real-time monitoring of file system, registry, and process activity for observing fileless attack behavior\n- **LOLBAS Project**: Community-documented catalog of LOLBin abuse techniques at https:\u002F\u002Flolbas-project.github.io\u002F\n\n## Common Scenarios\n\n### Scenario: Investigating a Fileless Attack Using WMI Persistence\n\n**Context**: Sysmon alerts show WMI event subscription creation followed by periodic PowerShell execution without any corresponding malware files on disk. The attack persists across reboots.\n\n**Approach**:\n1. Query WMI namespace for event filters, consumers, and bindings to identify the persistence mechanism\n2. Extract the CommandLineEventConsumer or ActiveScriptEventConsumer payload\n3. Decode the PowerShell command (typically Base64-encoded with -enc flag)\n4. Trace the PowerShell execution in Script Block Logging (Event ID 4104) for the full deobfuscated payload\n5. Analyze memory dump for reflectively loaded assemblies and injected code\n6. Check registry for additional stored payloads referenced by the PowerShell script\n7. Map the complete attack chain from initial access through persistence and lateral movement\n\n**Pitfalls**:\n- Not having Sysmon WMI event logging enabled (Events 19\u002F20\u002F21) before the incident\n- Rebooting the system before capturing a memory dump (destroys in-memory evidence)\n- Focusing only on file-based IOCs when the attack is entirely fileless\n- Missing the initial access vector because the LOLBin execution left minimal traces\n\n## Output Format\n\n```\nFILELESS MALWARE ANALYSIS REPORT\n===================================\nIncident:         INC-2025-2847\nAttack Type:      Fileless (no malware files on disk)\n\nINITIAL ACCESS\nVector:           Phishing email with macro-enabled document\nLOLBin Chain:     WINWORD.EXE -> mshta.exe -> powershell.exe\n\nPERSISTENCE MECHANISM\nType:             WMI Event Subscription\nFilter Name:      WindowsUpdateCheck\nFilter Query:     SELECT * FROM __InstanceModificationEvent WITHIN 300\n                  WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\nConsumer:         CommandLineEventConsumer\nCommand:          powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...\n\nDECODED PAYLOAD\n[Layer 1] Base64 UTF-16LE decode\n[Layer 2] AMSI bypass + Assembly.Load() of embedded .NET payload\n[Layer 3] .NET RAT with C2 communication to 185.220.101[.]42\n\nREGISTRY PAYLOADS\nHKCU\\Software\\AppDataLow\\Config\\data = [Base64 encoded .NET assembly, 247KB]\nLoaded by: PowerShell WMI consumer script\n\nMEMORY ARTIFACTS\nPID 4012 (powershell.exe): Injected .NET assembly at 0x00400000\n  - CobaltStrike beacon detected via YARA\n  - C2: hxxps:\u002F\u002F185.220.101[.]42\u002Fupdates\n\nEXTRACTED IOCs\nC2 IP:            185.220.101[.]42\nWMI Filter:       WindowsUpdateCheck\nRegistry Path:    HKCU\\Software\\AppDataLow\\Config\\data\nPowerShell Flags: -nop -w hidden -enc\n\nMITRE ATT&CK\nT1059.001  PowerShell\nT1546.003  WMI Event Subscription\nT1218.005  Mshta\nT1112      Modify Registry\nT1055.012  Process Hollowing\n```\n",{"name":5,"domain":22,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-technique-fileless","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-technique-fileless",{"tool":41,"command":42},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-technique-fileless",{"tool":44,"command":45},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-technique-fileless","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-technique-fileless\u002FSKILL.md",true,[49],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"index.json","REFERENCE","参考文档",504,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-technique-fileless\u002Findex.json",[56,81,104,126,148,164],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":23},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,22,80],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":23},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[88,63,89,66,90,91,92,22,93,94,95,96,97,98,68,99,100,101,102,103],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":110,"publishedAt":23},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[111,112,113,114,115,116,22,93,117,94,118,119,68,101,120,121,122,123,124,125],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":23},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[64,133,134,135,136,137,138,69,139,22,80,140,141,142,143,144,145,146,147,68],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":23},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[155,156,64,157,135,137,158,69,159,139,22,80,94,160,161,162,163,147,68,70],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":170,"publishedAt":23},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[171,64,135,172,158,69,173,174,22,80,175,176,177,178,179,180,68,70,181,182],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]