Fileless malware is an attack that avoids writing a traditional malicious executable to disk. It runs through tools already on the system, such as PowerShell or Windows Management Instrumentation, and often lives in memory or in system configuration. You detect it by watching behavior and logs, not by scanning for a bad file.
What does fileless really mean?
The name oversells it. Some part of the attack usually touches disk, such as a document that starts it or a registry entry that keeps it alive. What is missing is a standalone malware file that a signature scanner can find. The attacker borrows software you already trust, which is why the technique is also grouped under living off the land.
CISA and partner agencies published joint guidance on identifying and mitigating living off the land techniques in February 2024. It says many organizations do not implement security practices that support detection of this activity, and it provides detection and mitigation information that applies regardless of the actor.
Which tools are abused?
MITRE ATT&CK documents the main ones.
PowerShell, T1059.001. ATT&CK notes it can discover information, run code, and download and run executables from the internet, and that it can run from disk or in memory without touching disk.
WMI, T1047. Windows Management Instrumentation can run commands locally and remotely.
WMI event subscription, T1546.003. An attacker installs filters and consumers so that code runs when an event happens, such as a login or a point in uptime. ATT&CK lists it under both persistence and privilege escalation, and notes that execution is proxied by the WMI Provider Host process, which can give SYSTEM privileges. The persistence lives in the WMI repository, not in a startup file.
A constructed example
An employee opens a document with a macro. The macro starts PowerShell with an encoded command, which downloads a script into memory and registers a WMI event subscription that re-launches it every time the machine starts. A file scan finds nothing, because nothing malicious sits on disk. What exists is a chain of unusual parent and child processes, a long encoded command line, and a new WMI consumer. Those are the clues.
How do you detect it?
Look for behavior, not files.
Script logging. Turn on PowerShell script block logging and module logging, which record what was executed, including decoded content. Send those logs to central storage.
Process lineage. Alert on Office applications starting script interpreters, and on interpreters started with long encoded arguments.
WMI inventory. List existing WMI event subscriptions on a baseline machine, and alert when a new filter or consumer appears.
Memory and endpoint telemetry. Endpoint tools that observe process behavior and memory can catch what a file scan misses.
How do you reduce the exposure?
Limit who can run scripts and what they can do. Use application control so only approved programs and scripts run. Use PowerShell's constrained language mode for standard users. Remove admin rights that are not needed. Block macros from files that come from the internet. Keep the logging in place, since the CISA guidance stresses that detection depends on having the right logs and a baseline of normal activity.
How to check or apply this
- Enable PowerShell script block logging on all Windows endpoints and forward the logs.
- Baseline normal use of PowerShell and WMI by administrators and tools, so abnormal use stands out.
- Alert on Office applications launching script interpreters.
- Audit WMI event subscriptions regularly and alert on new ones.
- Deploy application control to limit what scripts and programs can run.
- Remove local admin rights from daily-use accounts.
- Test your detections with a safe simulation, using the technique IDs above as a checklist.
Quick check
Does antivirus catch fileless malware?
A scanner that relies on file signatures may miss it. Tools that observe process behavior and memory have a better chance. Logging and baselines help as well.
Is fileless malware truly invisible?
No. It leaves traces in process creation, command lines, script logs and WMI. You must collect them.
Sources
- CISA, Identifying and Mitigating Living Off the Land Techniques
- MITRE ATT&CK T1059.001, PowerShell
- MITRE ATT&CK T1047, Windows Management Instrumentation
- MITRE ATT&CK T1546.003, WMI Event Subscription
Last reviewed: 18 October 2026.
