What is fileless malware?¶
Fileless malware is malicious activity that operates mainly through memory, scripts, system tools or existing components rather than relying on a conventional malicious file stored on disk.
Avoid the dangerous assumption¶
The dangerous assumption is that no malware file means no malware activity.
It does not.
Fileless activity may use:
- PowerShell
- command shells
- scripting engines
- memory injection
- registry-stored code
- document macros
- legitimate administrative tools
- remote-management functions.
Some files may still be involved. The term usually means that the main malicious behaviour does not depend on a normal standalone executable remaining on disk.
Evidence may exist in:
- memory
- process creation
- command lines
- script logs
- security telemetry
- registry changes
- scheduled tasks
- network connections
- parent-child process relationships.
These artefacts may be volatile or retained for only a short period.
Investigators should avoid using “fileless” to imply sophistication or invisibility. The activity may still leave extensive traces.
Equally, normal administrators and applications use many of the same tools.
The evidential question is how the tool was used, by which account, against which resources and with what result.
A memory-only payload may disappear when the system is restarted, making early preservation important.
Do not shut down or remediate before considering whether live-response or memory capture is required.
Native logs may have been disabled or incomplete, so security telemetry and memory evidence can become especially important. Record collection timing because volatile artefacts may change rapidly during response.
Operational takeaway¶
Look beyond files to memory, scripts, process chains and system-tool use, and preserve volatile evidence before restart or remediation removes it.