fileless

Fileless refers to a class of cyberattack techniques in which malicious activity is executed without writing malware binaries to disk. Instead, code resides in memory or is executed through legitimate system processes and tools, often using living-off-the-land techniques (LOLBins). This approach reduces the presence of traditional on-disk indicators, making detection more challenging.

Common vectors include PowerShell and other scripting environments, Windows Management Instrumentation (WMI), mshta, regsvr32, and LOLBins such as certutil or bitsadmin. Attackers may also leverage memory-resident techniques like process hollowing or reflective DLL injection, and may abuse script blocks, memory payloads, or in-memory loaders to run components exclusively in RAM. Persistence can be achieved via in-memory tasks, WMI event subscriptions, or by abusing legitimate tools that survive reboots.

Because the malware does not leave traditional on-disk artifacts, detection relies on memory analysis, behavior monitoring, and telemetry from security tools. Defender strategies include enabling and monitoring script-block logging and AMSI with PowerShell, restricting the use of PowerShell and other interpreters, application allow lists, network monitoring for anomalous beaconing, and EDR solutions that can detect memory-resident payloads, process injection, or suspicious LOLBin use. Incident response often involves memory forensics to recover malware artifacts and to map attacker techniques.

The term is sometimes used broadly and lacks a single, formal definition; in practice, it covers a range of techniques that minimize disk activity and maximize runtime stealth, while still potentially exposing organization risk through network exfiltration, privilege escalation, or lateral movement.