CyberGlossary

Malware

Fileless Malware

Also known as: Memory-resident malware, Living-off-the-land malware

Definition

Malware that runs primarily in memory and leverages trusted system tools, avoiding the use of traditional executable files on disk.

Fileless malware minimizes its footprint on disk by living in memory and abusing legitimate components such as PowerShell, WMI, .NET, WSH, and the Windows Registry — a technique often called "living off the land" (LOLBins). Initial code may arrive through a phishing document, exploit or in-memory loader, then reflectively load further stages without ever writing them to disk. Because there is little or no payload file for signature-based AV to scan, fileless attacks are notably harder to detect. Defences include script-block and command-line logging, AMSI integration, EDR with behavioural and memory inspection, and constraining or signing PowerShell with Constrained Language Mode and WDAC.

Examples

  • PowerShell-based payloads of Cobalt Strike Beacon loaded reflectively into memory.
  • POWELIKS, fileless malware that stored encoded payloads in the Windows Registry.

Related terms