Fileless malware is a type of malicious software that uses legitimate applications already installed to infect a computer. It doesn’t rely on files and doesn’t leave a footprint since the malware is memory-based and not file-based. Fileless malware doesn’t require code to be installed, but an attacker still needs to be able to gain access to the environment to modify the native tools already in a user’s operating system. This fileless technique of using native tools to conduct a malicious attack is known as “living off the land.”
Common characteristics of a fileless malware attack include:
- Leverages approved applications that are already within the system
- Does not have identifiable or detectable code
- Does not have identifiable behavior
- Is memory-based—it lives in the system’s memory
- Uses processes that are built into the operating system
- Is paired with other types of malware
- Remains in an environment despite whitelisting and sandboxing efforts
Well known fileless malware attacks include:
- SQL Slammer: A 2003 attack that exploited a vulnerability in Microsoft SQL servers and caused a Denial of Service (DoS) on internet hosts and dramatically slowed general internet traffic.
- Stuxnet: First uncovered in 2010 but thought to be in development since 2005, a worm designed to infect nuclear enrichment systems. Stuxnet is believed to be responsible for causing damage to the nuclear program of Iran.
- UIWIZ: A threat discovered in 2017 that exploited the same vulnerabilities as the WannaCry ransomware attack, but was fileless.
How fileless malware works
Fileless malware attacks use existing vulnerabilities already installed on a computer to infiltrate, take control, and carry out the attack. It doesn’t need to be installed or downloaded. A fileless attack may be triggered by a user-initiated action, such as clicking an advertisement that redirects to access Flash, and then uses other applications on the device.
Once into the system, specifically in the computer’s RAM, the malware injects malicious code. It gains access to native Windows tools, such as PowerShell and Windows Management Instrumentation (WMI) and injects code. These tools are targeted because they carry out system tasks for multiple endpoints.
This type of malware exists only in a computer’s RAM, meaning nothing is written directly to the hard drive. While this means an attacker has a smaller window of opportunity to execute the attack if a system reboot were to occur, it also means it’s more difficult to detect because there are no stored files for defensive security software to scan.
How to prevent fileless malware
While fileless malware attacks are difficult to detect, it’s not impossible, and they do leave traces of evidence behind, including a compromise in a device’s system memory. Some antivirus software provides analytics that can detect when an application is executed at the same time as PowerShell. To minimize risk, consider using these approaches:
- Disable PowerShell and WMI if they’re not in use
- Disable macros if not in use
- Regularly check security logs for inordinate amounts of data leaving the network
- Secure system endpoints
- Looks for changes in the system’s behavioral patterns
- Update software regularly
- If an attack has occured, change system passwords
