Security Operations · Intermediate

Fileless Malware

Malware that runs in memory and abuses legitimate system tools instead of writing malicious executables to disk.

Definition

Fileless attacks use PowerShell, WMI, scripts, registry-stored payloads and process injection, leaving few artifacts for signature-based antivirus. Persistence may be achieved through registry run keys or WMI event subscriptions. Detection relies on behavioral EDR, script block logging, AMSI and memory forensics.

Related terms