Fileless Malware

Fileless malware is a type of malicious software that uses legitimate applications already installed to infect a computer. It doesn’t rely on files and doesn’t leave a footprint since the malware is memory-based and not file-based. Fileless malware doesn’t require code to be installed, but an attacker still needs to be able to gain access to the environment to modify the native tools already in a user’s operating system. This fileless technique of using native tools to conduct a malicious attack is known as “living off the land.”

Common characteristics of a fileless malware attack include:

  • Leverages approved applications that are already within the system
  • Does not have identifiable or detectable code
  • Does not have identifiable behavior
  • Is memory-based—it lives in the system’s memory
  • Uses processes that are built into the operating system
  • Is paired with other types of malware
  • Remains in an environment despite whitelisting and sandboxing efforts

Well known fileless malware attacks include:

  • SQL Slammer: A 2003 attack that exploited a vulnerability in Microsoft SQL servers and caused a Denial of Service (DoS) on internet hosts and dramatically slowed general internet traffic.
  • Stuxnet: First uncovered in 2010 but thought to be in development since 2005, a worm designed to infect nuclear enrichment systems. Stuxnet is believed to be responsible for causing damage to the nuclear program of Iran.
  • UIWIZ: A threat discovered in 2017 that exploited the same vulnerabilities as the WannaCry ransomware attack, but was fileless.

How fileless malware works

Fileless malware attacks use existing vulnerabilities already installed on a computer to infiltrate, take control, and carry out the attack. It doesn’t need to be installed or downloaded. A fileless attack may be triggered by a user-initiated action, such as clicking an advertisement that redirects to access Flash, and then uses other applications on the device.

Once into the system, specifically in the computer’s RAM, the malware injects malicious code. It gains access to native Windows tools, such as PowerShell and Windows Management Instrumentation (WMI) and injects code. These tools are targeted because they carry out system tasks for multiple endpoints.

This type of malware exists only in a computer’s RAM, meaning nothing is written directly to the hard drive. While this means an attacker has a smaller window of opportunity to execute the attack if a system reboot were to occur, it also means it’s more difficult to detect because there are no stored files for defensive security software to scan.

How to prevent fileless malware

While fileless malware attacks are difficult to detect, it’s not impossible, and they do leave traces of evidence behind, including a compromise in a device’s system memory. Some antivirus software provides analytics that can detect when an application is executed at the same time as PowerShell. To minimize risk, consider using these approaches:

  • Disable PowerShell and WMI if they’re not in use
  • Disable macros if not in use
  • Regularly check security logs for inordinate amounts of data leaving the network
  • Secure system endpoints
  • Looks for changes in the system’s behavioral patterns
  • Update software regularly
  • If an attack has occured, change system passwords


Abby Braden
Abby Braden
Abby Braden is an award-winning writer and editor for websites such as,, and, where she covers technology trends and enterprise and SMB project management platforms. When she’s not writing about technology, she enjoys giving too many treats to her dog and coaching part-time at her local gym.
Get the Free Newsletter
Subscribe to Daily Tech Insider for top news, trends & analysis
This email address is invalid.
Get the Free Newsletter
Subscribe to Daily Tech Insider for top news, trends & analysis
This email address is invalid.

Related Articles

Virtual Private Network (VPN)

A virtual private network (VPN) encrypts a device's Internet access through a secure server. It is most frequently used for remote employees accessing a...

Gantt Chart

A Gantt chart is a type of bar chart that illustrates a project schedule and shows the dependency between tasks and the current schedule...

Input Sanitization

Input sanitization is a cybersecurity measure of checking, cleaning, and filtering data inputs from users, APIs, and web services of any unwanted characters and...

IT Asset Management Software

IT asset management software (ITAM software) is an application for organizing, recording, and tracking all of an organization s hardware and software assets throughout...


ScalaHosting is a leading managed hosting provider that offers secure, scalable, and affordable...


Human resources information system (HRIS) solutions help businesses manage multiple facets of their...

Best Managed Service Providers...

In today's business world, managed services are more critical than ever. They can...