What is Fileless Malware?

The defining trait is what it avoids leaving behind, not a specific technique. Traditional malware detection assumes a malicious file exists somewhere on disk to be hashed, signature-matched, or sandboxed, and antivirus engines are built around that assumption. Fileless techniques sidestep it by abusing tools the operating system ships with and implicitly trusts: PowerShell executing an obfuscated, base64-encoded command directly from memory, Windows Management Instrumentation (WMI) used for both execution and persistence, or a malicious macro in an Office document that never drops a payload file, instead using process injection to run shellcode directly inside the memory space of an already-running, legitimate process like explorer.exe or svchost.exe.

Persistence without a file is achieved through registry-based techniques, storing an encoded PowerShell payload inside a registry key that a scheduled task or WMI event subscription triggers on a schedule or system event, so the malicious logic survives a reboot without ever touching the file system as an executable. Reflective DLL injection loads a malicious library directly from memory into a process's address space, bypassing the normal Windows loader and the disk-based artifacts that loader would otherwise create. Attackers also abuse legitimate remote administration tools already present in the environment, PsExec, certutil, mshta, rundll32, a technique class known as living-off-the-land binaries (LOLBins), specifically because defenders can't simply blocklist tools the business also depends on for normal IT operations.

Detecting fileless activity means shifting from file-based scanning to behavioral and memory-based analysis. EDR agents that monitor process creation, parent-child relationships, and command-line arguments catch fileless techniques by recognizing the pattern, PowerShell launched by an Office application with a suspicious encoded command, rather than by matching a file hash that doesn't exist. Memory forensics tools (Volatility, memory-scanning modules built into modern EDR) can extract injected code directly from a running process's memory even when nothing was ever written to disk. AMSI (Antimalware Scan Interface) in Windows exposes script content, including PowerShell and VBA, to registered antivirus engines at execution time regardless of whether it originated from a file, closing part of the historical blind spot.