Detecting Fileless Attacks on Endpoints
When to Use
Use this skill when:
- Building detection rules for fileless malware that operates entirely in memory
- Hunting for PowerShell-based attacks, reflective DLL injection, and WMI abuse
- Configuring endpoint telemetry (Sysmon, AMSI, PowerShell logging) to capture fileless indicators
- Investigating incidents where traditional AV found no malicious files
Do not use for detecting file-based malware or for malware reverse engineering.
Detection Gaps & Validation
- PowerShell logging declared but not capturing: Script Block (4104) and Module Logging must be set machine-wide (HKLM, not HKCU) and apply to PowerShell v5+; a v2 downgrade (
powershell -version 2) evades 4104 entirely. Confirm 4104 text is present for a known script before trusting a clean result.
- AMSI/ETW bypass blinds content inspection: in-memory
amsi.dll patches and ETW patching suppress AMSI and 4104 events. Detect the bypass itself — 4104 containing AmsiUtils/amsiInitFailed/[Ref].Assembly.GetType — and treat an abrupt halt in script-block events as suspicious.
- Reflective/in-memory loads leave no disk artifact: rely on Sysmon EID 7 (ImageLoaded from non-standard paths), EID 8 (CreateRemoteThread), and EID 10 (ProcessAccess to lsass
0x1010); direct-syscall loaders may bypass EID 8, so back them with MDE CreateRemoteThreadApiCall/NtAllocateVirtualMemoryApiCall.
- WMI persistence missed when 19/20/21 are off: many Sysmon configs omit WmiEvent logging. Confirm EID 19-21 are enabled and that
__FilterToConsumerBinding enumeration runs.
- Validate each detection: run Atomic Red Team T1059.001 (encoded PowerShell / download cradle), T1620 (reflective load), and T1546.003 (WMI event subscription) and confirm 4104, Sysmon 7/8, and 19-21 events reach the SIEM. Tune encoded-command false positives against known admin tooling instead of dropping the rule.
Prerequisites
- Sysmon with process creation and WMI event logging enabled
- PowerShell Script Block Logging and Module Logging enabled
- AMSI (Antimalware Scan Interface) enabled for script content inspection
- EDR with behavioral detection capabilities (MDE, CrowdStrike, SentinelOne)
Workflow
Step 1: Enable Required Telemetry
# Enable PowerShell Script Block Logging (GPO or registry)
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
-Name EnableScriptBlockLogging -Value 1 -PropertyType DWORD -Force
# Enable PowerShell Module Logging
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" `
-Name EnableModuleLogging -Value 1 -PropertyType DWORD -Force
# Enable PowerShell Transcription
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" `
-Name EnableTranscripting -Value 1 -PropertyType DWORD -Force
# Sysmon config for fileless detection (key events):
# Event ID 1: Process creation (captures CommandLine)
# Event ID 7: Image loaded (DLL loading)
# Event ID 8: CreateRemoteThread (injection)
# Event ID 10: Process access (LSASS access)
# Event ID 19/20/21: WMI events
Step 2: Detect PowerShell-Based Attacks
# Indicators of malicious PowerShell:
# Encoded command execution
EventID: 1
CommandLine contains: "powershell" AND ("-enc" OR "-e " OR "-encodedcommand" OR "FromBase64String")
# Download cradle patterns
CommandLine contains: "IEX" AND ("Net.WebClient" OR "DownloadString" OR "Invoke-WebRequest")
CommandLine contains: "Invoke-Expression" AND "New-Object"
# AMSI bypass attempts (Event ID 4104 - Script Block)
ScriptBlock contains: ("Amsi"+"Utils") OR ("amsi"+"InitFailed") OR "SetValue.*amsi"
# Splunk query for suspicious PowerShell:
index=windows source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsi.utils)")
| table _time host ScriptBlockText
Step 3: Detect Process Injection Techniques
# Reflective DLL injection - loads DLL from memory without touching disk
# Detection: Sysmon Event 7 (ImageLoaded) where image path is unusual
EventID: 7
ImageLoaded NOT starts with: "C:\Windows\" AND NOT starts with: "C:\Program Files"
# Process hollowing - creates process in suspended state, replaces memory
# Detection: Process creation followed by immediate memory write
EventID: 1 + 10 correlation
# Process created then accessed with PROCESS_VM_WRITE
# APC injection - queues code to thread's async procedure call queue
# Detection: Sysmon CreateRemoteThread from non-system process
EventID: 8
SourceImage NOT IN (known_legitimate_sources)
# MDE KQL:
DeviceEvents
| where ActionType in ("CreateRemoteThreadApiCall", "NtAllocateVirtualMemoryApiCall")
| where InitiatingProcessFileName !in ("MsMpEng.exe", "svchost.exe")
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName,
InitiatingProcessCommandLine, FileName
Step 4: Detect WMI-Based Persistence
# Sysmon Event IDs 19/20/21 for WMI events
EventID: 19 # WmiEventFilter activity detected
EventID: 20 # WmiEventConsumer activity detected
EventID: 21 # WmiEventConsumerToFilter activity detected
# Any WMI event subscription creation is suspicious unless expected
# Common malicious WMI persistence:
Consumer contains: "CommandLineEventConsumer" OR "ActiveScriptEventConsumer"
# Query for WMI subscriptions via osquery or PowerShell:
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding
Step 5: Detect Registry-Based Execution
# Malware stored in registry values and executed via PowerShell
# Sysmon Event 13 - Registry value set with encoded content
EventID: 13
TargetObject contains: "CurrentVersion\Run"
Details: unusually long value or Base64-encoded content
# Detection query:
index=sysmon EventCode=13
| where match(Details, "[A-Za-z0-9+/=]{100,}")
| table _time host TargetObject Details Image
Key Concepts
| Term |
Definition |
| Fileless Malware |
Malware that operates entirely in memory without writing executable files to disk |
| AMSI |
Antimalware Scan Interface; Windows API allowing security products to inspect script content before execution |
| Reflective DLL Injection |
Loading a DLL from memory rather than disk, avoiding file-based detection |
| Process Hollowing |
Creating a legitimate process in suspended state and replacing its memory with malicious code |
| Script Block Logging |
PowerShell logging feature that captures deobfuscated script content (Event ID 4104) |
Tools & Systems
- Sysmon: Kernel-level process, DLL, and WMI monitoring
- AMSI: Windows script content inspection API
- PowerShell Logging: Script Block, Module, and Transcription logging
- Microsoft Defender for Endpoint: Behavioral detection for fileless techniques
- Volatility 3: Memory forensics for post-incident fileless malware analysis
Common Pitfalls
- Relying on file-based AV: Traditional AV that scans files on disk will miss fileless attacks entirely. Behavioral detection and AMSI are required.
- Disabled PowerShell logging: Without Script Block Logging, deobfuscated PowerShell commands are invisible to defenders.
- AMSI bypass not detected: Sophisticated attackers bypass AMSI before executing payloads. Detect AMSI bypass attempts as a high-priority alert.
- Not monitoring WMI events: WMI persistence is a favored technique of APT groups. Sysmon events 19-21 must be enabled.
1---2name: detecting-fileless-attacks-on-endpoints3description: Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.4license: Apache-2.05---6# Detecting Fileless Attacks on Endpoints
7
8## When to Use
9
10Use this skill when:
11- Building detection rules for fileless malware that operates entirely in memory
12- Hunting for PowerShell-based attacks, reflective DLL injection, and WMI abuse
13- Configuring endpoint telemetry (Sysmon, AMSI, PowerShell logging) to capture fileless indicators
14- Investigating incidents where traditional AV found no malicious files
15
16**Do not use** for detecting file-based malware or for malware reverse engineering.
17
18## Detection Gaps & Validation
19
20- **PowerShell logging declared but not capturing:** Script Block (4104) and Module Logging must be set machine-wide (HKLM, not HKCU) and apply to PowerShell v5+; a v2 downgrade (`powershell -version 2`) evades 4104 entirely. Confirm 4104 text is present for a known script before trusting a clean result.
21- **AMSI/ETW bypass blinds content inspection:** in-memory `amsi.dll` patches and ETW patching suppress AMSI and 4104 events. Detect the bypass itself — 4104 containing `AmsiUtils`/`amsiInitFailed`/`[Ref].Assembly.GetType` — and treat an abrupt halt in script-block events as suspicious.
22- **Reflective/in-memory loads leave no disk artifact:** rely on Sysmon EID 7 (ImageLoaded from non-standard paths), EID 8 (CreateRemoteThread), and EID 10 (ProcessAccess to lsass `0x1010`); direct-syscall loaders may bypass EID 8, so back them with MDE `CreateRemoteThreadApiCall`/`NtAllocateVirtualMemoryApiCall`.
23- **WMI persistence missed when 19/20/21 are off:** many Sysmon configs omit WmiEvent logging. Confirm EID 19-21 are enabled and that `__FilterToConsumerBinding` enumeration runs.
24- **Validate each detection:** run Atomic Red Team T1059.001 (encoded PowerShell / download cradle), T1620 (reflective load), and T1546.003 (WMI event subscription) and confirm 4104, Sysmon 7/8, and 19-21 events reach the SIEM. Tune encoded-command false positives against known admin tooling instead of dropping the rule.
25
26## Prerequisites
27
28- Sysmon with process creation and WMI event logging enabled
29- PowerShell Script Block Logging and Module Logging enabled
30- AMSI (Antimalware Scan Interface) enabled for script content inspection
31- EDR with behavioral detection capabilities (MDE, CrowdStrike, SentinelOne)
32
33## Workflow
34
35### Step 1: Enable Required Telemetry
36
37```powershell
38# Enable PowerShell Script Block Logging (GPO or registry)
39New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
40 -Name EnableScriptBlockLogging -Value 1 -PropertyType DWORD -Force
41
42# Enable PowerShell Module Logging
43New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" `
44 -Name EnableModuleLogging -Value 1 -PropertyType DWORD -Force
45
46# Enable PowerShell Transcription
47New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" `
48 -Name EnableTranscripting -Value 1 -PropertyType DWORD -Force
49
50# Sysmon config for fileless detection (key events):
51# Event ID 1: Process creation (captures CommandLine)
52# Event ID 7: Image loaded (DLL loading)
53# Event ID 8: CreateRemoteThread (injection)
54# Event ID 10: Process access (LSASS access)
55# Event ID 19/20/21: WMI events
56```
57
58### Step 2: Detect PowerShell-Based Attacks
59
60```
61# Indicators of malicious PowerShell:
62
63# Encoded command execution
64EventID: 1
65CommandLine contains: "powershell" AND ("-enc" OR "-e " OR "-encodedcommand" OR "FromBase64String")
66
67# Download cradle patterns
68CommandLine contains: "IEX" AND ("Net.WebClient" OR "DownloadString" OR "Invoke-WebRequest")
69CommandLine contains: "Invoke-Expression" AND "New-Object"
70
71# AMSI bypass attempts (Event ID 4104 - Script Block)
72ScriptBlock contains: ("Amsi"+"Utils") OR ("amsi"+"InitFailed") OR "SetValue.*amsi"
73
74# Splunk query for suspicious PowerShell:
75index=windows source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
76| where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsi.utils)")
77| table _time host ScriptBlockText
78```
79
80### Step 3: Detect Process Injection Techniques
81
82```
83# Reflective DLL injection - loads DLL from memory without touching disk
84# Detection: Sysmon Event 7 (ImageLoaded) where image path is unusual
85EventID: 7
86ImageLoaded NOT starts with: "C:\Windows\" AND NOT starts with: "C:\Program Files"
87
88# Process hollowing - creates process in suspended state, replaces memory
89# Detection: Process creation followed by immediate memory write
90EventID: 1 + 10 correlation
91# Process created then accessed with PROCESS_VM_WRITE
92
93# APC injection - queues code to thread's async procedure call queue
94# Detection: Sysmon CreateRemoteThread from non-system process
95EventID: 8
96SourceImage NOT IN (known_legitimate_sources)
97
98# MDE KQL:
99DeviceEvents
100| where ActionType in ("CreateRemoteThreadApiCall", "NtAllocateVirtualMemoryApiCall")
101| where InitiatingProcessFileName !in ("MsMpEng.exe", "svchost.exe")
102| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName,
103 InitiatingProcessCommandLine, FileName
104```
105
106### Step 4: Detect WMI-Based Persistence
107
108```
109# Sysmon Event IDs 19/20/21 for WMI events
110EventID: 19 # WmiEventFilter activity detected
111EventID: 20 # WmiEventConsumer activity detected
112EventID: 21 # WmiEventConsumerToFilter activity detected
113
114# Any WMI event subscription creation is suspicious unless expected
115# Common malicious WMI persistence:
116Consumer contains: "CommandLineEventConsumer" OR "ActiveScriptEventConsumer"
117
118# Query for WMI subscriptions via osquery or PowerShell:
119Get-WMIObject -Namespace root\Subscription -Class __EventFilter
120Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
121Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding
122```
123
124### Step 5: Detect Registry-Based Execution
125
126```
127# Malware stored in registry values and executed via PowerShell
128# Sysmon Event 13 - Registry value set with encoded content
129EventID: 13
130TargetObject contains: "CurrentVersion\Run"
131Details: unusually long value or Base64-encoded content
132
133# Detection query:
134index=sysmon EventCode=13
135| where match(Details, "[A-Za-z0-9+/=]{100,}")
136| table _time host TargetObject Details Image
137```
138
139## Key Concepts
140
141| Term | Definition |
142|------|-----------|
143| **Fileless Malware** | Malware that operates entirely in memory without writing executable files to disk |
144| **AMSI** | Antimalware Scan Interface; Windows API allowing security products to inspect script content before execution |
145| **Reflective DLL Injection** | Loading a DLL from memory rather than disk, avoiding file-based detection |
146| **Process Hollowing** | Creating a legitimate process in suspended state and replacing its memory with malicious code |
147| **Script Block Logging** | PowerShell logging feature that captures deobfuscated script content (Event ID 4104) |
148
149## Tools & Systems
150
151- **Sysmon**: Kernel-level process, DLL, and WMI monitoring
152- **AMSI**: Windows script content inspection API
153- **PowerShell Logging**: Script Block, Module, and Transcription logging
154- **Microsoft Defender for Endpoint**: Behavioral detection for fileless techniques
155- **Volatility 3**: Memory forensics for post-incident fileless malware analysis
156
157## Common Pitfalls
158
159- **Relying on file-based AV**: Traditional AV that scans files on disk will miss fileless attacks entirely. Behavioral detection and AMSI are required.
160- **Disabled PowerShell logging**: Without Script Block Logging, deobfuscated PowerShell commands are invisible to defenders.
161- **AMSI bypass not detected**: Sophisticated attackers bypass AMSI before executing payloads. Detect AMSI bypass attempts as a high-priority alert.
162- **Not monitoring WMI events**: WMI persistence is a favored technique of APT groups. Sysmon events 19-21 must be enabled.
gabrielmoreira