Malware
Fileless Malware
Also known as: Memory-resident malware, Living-off-the-land malware
Definition
Malware that runs primarily in memory and leverages trusted system tools, avoiding the use of traditional executable files on disk.
Examples
- PowerShell-based payloads of Cobalt Strike Beacon loaded reflectively into memory.
- POWELIKS, fileless malware that stored encoded payloads in the Windows Registry.
Related terms
Stealth Malware
Malware specifically engineered to evade detection by users, security tools, and forensic investigators through hiding, mimicry, and anti-analysis tricks.
Polymorphic Malware
Malware that changes its on-disk appearance — typically via re-encryption or packing — for each infection, while keeping its core logic intact.
Memory Forensics
The discipline of acquiring and analysing a system's volatile RAM to reveal running processes, network connections, injected code, and in-memory artefacts.
EDR (Endpoint Detection and Response)
An endpoint security technology that continuously records process, file, registry and network activity to detect, investigate and respond to threats on hosts.
Loader
Malware that prepares the environment and loads further payloads — often directly into memory — for a subsequent stage of an attack.
Malware
Any software intentionally designed to disrupt, damage, or gain unauthorized access to computers, networks, or data.