What is Fileless Malware
Fileless malware goes by many names, including ‘non-malware’, ‘memory-based malware’ and ‘living off the land attacks’
Fileless Malware is not like traditional malware that install files on a computer to perform its task but it is like command based malware that hijack built-in tools of windows like PowerShell and WMI (Windows Management Instrumentation)
This makes it difficult for traditional antivirus programs to detect the malware since PowerShell and WMI are legitimate programs, any command they execute is assumed to also be legitimate.
How does it work - example
Where does it reside
- RAM - some fileless malware reside here without placing themselves in hard drive, this type is uncommon as the RAM clears as soon as the system is restarted
- Registry - Registry is a database of low level settings that windows and softwares use some fileless malware store themselves here in undetectable way
What makes it so powerful and dangerous
- Fileless Malware is not detectable by traditional Antivirus
- Fileless malware use PowerShell which is a powerful scripting language that has access to machines inner cores and windows API also it can be used to execute commands remotely with high privileges.
- Fileless malware use WMI which allows Administrators to install software, change user privileges, allocate resources this is mostly used by IT Administrators, hence this is a very powerful tool misused by malware
How to protect yourself from Fileless Malware
- Keep your operating system and softwares upto date ~ Fileless malware finds vulnerabilities in old softwares and exploit it
- Disable PowerShell if not required
- Use Antivirus with behavioral detection ~Antivirus may not detect Fileless malware using file properties, it should be able to detect unusual or suspicious activities
- Follow the principle of least privilege ~ do not give excess privileges to user who may not require it, as more the privileges more the chances of Malware to work at elevated authority, this is why IT firms don’t give Admin privileges to employees easily
Sources & Artwork
www.bleepingcomputer.com
www.eset.com
www.cybereason.com
blog.emsisoft.com
