What is fileless malware?
Fileless malware is malicious code that runs mainly in memory and uses tools already on the system, rather than installing a traditional executable file. Antivirus has long worked by inspecting files, so an attack that never writes a malicious program to disk, or writes only a small script or configuration change, can pass a file scan. The code typically runs inside a legitimate process, so what the system shows is a trusted program behaving strangely rather than an unknown executable.
How a fileless attack works
A typical chain starts with something allowed: a document with a malicious macro, a script attachment or a browser exploit. Instead of saving a program, it starts a built-in interpreter such as PowerShell, which retrieves a payload and runs it directly in memory. The payload may inject itself into a normal process so it blends in. Because memory is cleared on reboot, attackers add persistence that also avoids obvious files:
- An encoded script stored in a registry value, launched by a run key at logon
- A WMI event subscription that runs a command when a system event occurs
- A scheduled task that launches a built-in interpreter with a script
The persistence looks like configuration, not like a program, so there may be no suspicious executable to quarantine.
Indicators of fileless malware
- A host that is clearly compromised, for example beaconing to a known malicious address, while file scans come back clean
- An Office application starting PowerShell or another script interpreter
- PowerShell running with a hidden window and an encoded command
- A legitimate process making unexpected network connections
- Unfamiliar WMI subscriptions, registry values holding long encoded strings, or scheduled tasks that call interpreters
How to defend against fileless malware
Defenses focus on behavior and memory rather than files:
- EDR that watches process behavior, parent-child relationships and memory activity.
- PowerShell script block logging (event ID 4104) and transcription, so decoded commands are recorded.
- AMSI (Antimalware Scan Interface), which lets security products inspect script content at run time, after it is decoded.
- Constrained language mode and application control policies that limit what scripts can do.
- Blocking macros in files from the internet, and removing PowerShell 2.0, which lacks these protections.
Remediation must remove the persistence configuration, such as the registry value, WMI subscription or scheduled task, not just end the running process.
Fileless malware vs. living off the land
The two overlap heavily. Fileless describes where the malicious code lives: in memory and configuration rather than in program files. Living off the land describes the tools used: legitimate, signed system binaries instead of custom malware. Most fileless attacks live off the land, but a living-off-the-land attack can still write files to disk.
Fileless malware on the CompTIA Security+ exam
Fileless malware is one of the malware types in SY0-801 objective 2.5. Scenario wording that points to it says antivirus found nothing but the host is compromised, or that analysis shows code running in memory, PowerShell with encoded commands, or persistence in WMI or the registry. The right next step is behavioral analysis with EDR and logging, not another file scan. Distractors include rootkit, trojan, virus and living off the land. The term also appears in A+ Core 2 (220-1202) objective 2.4.