Fileless malware: what it is and how it fools your antivirus

You install a good antivirus, keep Windows updated, and your machine can still be compromised without a single suspicious file showing up on disk. That's what fileless malware does: the malicious code lives entirely in RAM, disguises itself as legitimate system tools and vanishes with the next reboot — but not before doing the damage.

What is fileless malware?

Fileless malware is malicious code that writes no executables to the hard drive. Instead of creating an .exe or .dll file that can be detected by signature, it runs directly in RAM, injecting commands into legitimate operating system processes.

The strategy behind it has a name: Living off the Land (LotL). The attacker doesn't bring their own tools — they use what's already installed: PowerShell, WMI (Windows Management Instrumentation), cmd.exe, mshta.exe, regsvr32.exe. Trusted tools, signed by Microsoft, that antivirus won't block by default.

Why doesn't traditional antivirus detect fileless malware?

Because signature-based antivirus looks for files on disk — and here there's no file to look for. The code exists only in memory, executed inside a legitimate process. To classic antivirus, it looks like PowerShell is simply running normally.

According to the Ponemon Institute, fileless attacks are 10 times more likely to succeed than file-based attacks. In 2023, 79% of targeted attacks used LotL techniques, according to Broadcom/Symantec data — and the trend keeps growing.

How the attack works in practice

The most common entry point is a phishing email with a malicious Word or Excel document. You open the file, Office asks you to enable macros — and that's it. The macro installs nothing: it fires up PowerShell directly, which downloads and executes the payload entirely in memory, without touching the disk.

The typical flow of a fileless attack:

1. Victim opens a document with a malicious macro (phishing or drive-by download)
2. The macro calls PowerShell with a Base64-encoded command
3. PowerShell decodes and executes the payload in RAM
4. The payload opens a reverse connection to the attacker's server (C2)
5. The attacker has access to the system — with no file written to disk

Another frequent technique is process hollowing: the malware starts a legitimate process such as explorer.exe or svchost.exe, empties its contents and injects malicious code into that process's memory space. To the operating system, it still looks like a normal running process.

There are also attacks that use the Windows registry for persistence: an obfuscated script stored in a registry key is executed via PowerShell at every startup. The only trace on disk is a registry key — there's no executable file.

Who uses fileless malware?

Because it's more complex to develop, fileless malware shows up frequently in APT (Advanced Persistent Threat) campaigns — nation-state groups or high-level cybercriminals. APT29 (Cozy Bear, linked to the Russian government) and the Lazarus Group (North Korea) have a documented history of heavy LotL use in espionage and sabotage attacks.

But access to these techniques has been democratized. Exploit kits sold on dark web forums already include fileless modules. BlackMamba, an example of malware combining AI with advanced evasion, used similar in-memory execution techniques to escape sandboxes.

How to detect fileless attacks

With no file on disk, detection depends on behavioral monitoring and event logging. The main tools:

• PowerShell ScriptBlock Logging: records the contents of every PowerShell script executed — including those decoded from Base64 in real time. It's the most valuable log against LotL attacks. See how to enable and analyze PowerShell audit logs on Windows.
• Sysmon: a free Microsoft tool that logs process creation, network connections and memory injection in far more detail than the standard Windows log. It's practically mandatory in any environment that takes security seriously.
• EDR (Endpoint Detection and Response): solutions like Microsoft Defender for Endpoint, CrowdStrike and SentinelOne do real-time behavioral analysis — they detect suspicious patterns of PowerShell or WMI use even without a known malware signature.
• Forensic memory analysis: in incident response, tools like Volatility let you examine a RAM dump looking for injected code and open connections that appear in no file at all.

How to protect yourself

There's no single protection, but a few settings significantly reduce the attack surface:

• Disable Office macros by default — or restrict macros to digitally signed documents. It's the most common entry vector in fileless attacks.
• Constrained Language Mode in PowerShell: limits which commands PowerShell can execute, making malicious use of its most powerful capabilities harder.
• Application whitelisting (AppLocker / WDAC): defines which executables and scripts are allowed to run on the system. Unauthorized PowerShell scripts are blocked before they even execute.
• AMSI (Antimalware Scan Interface): present in Windows 10+ and integrated with PowerShell 5+, it lets security solutions scan scripts before execution — even when the content exists only in memory.
• Principle of least privilege: a standard user without administrator rights can't run a good share of the commands that make LotL attacks effective. It shrinks the blast radius if the attack starts.
• Patches up to date: many fileless attacks exploit browser or plugin vulnerabilities as the initial entry point, before moving laterally with LotL techniques.

At bottom, fileless malware is the combination of social engineering with abuse of legitimate system tools. Blocking it requires a different defensive layer from the traditional ones: less focus on files and signatures, more focus on behavior, logging and privilege restriction.

What to do now

If you administer Windows machines, two immediate steps make a difference: enabling PowerShell ScriptBlock Logging and installing Sysmon with a reasonable configuration profile (the SwiftOnSecurity project on GitHub is a good starting point). Those two measures turn a blind environment into one with basic visibility into what legitimate processes are actually doing. The full PowerShell auditing guide is at how to monitor PowerShell with audit logs on Windows.