A fileless malware is a special type of malware that abuses and exploits legitimate programs to infect the system. It does not rely on executing or downloading some file and then infecting, thus leaving no footprint and making it harder to detect and remove.
It targets the programs and applications present in the system’s RAM and abuses their functionality to infect the system.
Anatomy of a Fileless Malware Attack
Fileless malware fall into the category of Low-Observable-Characteristics (LOC) and Living Off the Land (LOL) attacks, which are a type of stealth attacks that evade most of the security solutions and makes digital forensics and incident response a hell of a job. Fileless malware do not have a signature attack pattern and are not associated with any particular attack vector. They may exploit a zero-day vulnerability in an Operating System or inject some malicious code into the memory. The most commonly exploited programs are listed in LOLBAS, which includes Windows PowerShell, Microsoft Office macros and Windows Management Instrumentation (WMI) to list a few. The principle of operation of such malware is simple: “Use a legitimate activity to mask an illegitimate activity.“
Browser Exploitations and Fileless Intrusions
In recent times, web browsers have been the target of most fileless attacks, because of the fact that web browsers are usually installed on every system and the attacker can very easily target a user using a web browser. The attacker has to find a command in the browser’s application code, a function or a method that uses system calls, and he can prepare an exploit code by injecting his own shellcode and abusing the system calls.
Let us consider the example of MS12-063. It was disclosed in 2012 and affects all versions of Internet Explorer prior to IE 10. There’s a dependency of the exploit that the target system should have java installed on the system. This exploit abuses the “execCommand” system call of Internet Explorer, and uses Java Return Object Programming (ROP) to achieve Remote Code Execution.
Detection Analysis of a Fileless Malware
As no traditional malware is used, therefore it becomes difficult for end-point security solutions to detect the attack, as there is no signature that an antivirus would detect. This type of malware resides almost completely in the memory and use legitimate processes and system programs to propagate. This makes it challenging for security analysts to decide which application is being used for a benign activity and which is not.
How to Defend Against Fileless Malware Attacks
- Frequently check and detect PowerShell, CMD and other benign applications for unusual activities when not in use.
- Conduct regular security assessments on the network and the system.
- Remove the administrative use of internet browsers, PowerShell etc. by restricting access via the Windows Group Policy.
- Restrict internet browsers and flash players to launch interpreters.
- Install and EDR and MDR and turn on strict monitoring for any anomalous behavior.