2

I feel there are so many articles talking about fileless malware, so I was trying to understand is it a new type of attack or those articles are just kind of promoting new cyber solutions?

3 Answers 3

4

Fileless malware has been around for years. It is nothing new. Any malware that runs in memory is considered "fileless".

The common media also has the misconception of thinking that a malware running from the Registry is fileless. Since the Registry is written to the disk inside Registry hives, it isn't really fileless. Same thing for malware that uses WMI.

Real fileless malware is malware that simply lives in a process, in the memory of an hijacked process (since if it was launched from its own image, it wouldn't be fileless, as it would have a trace on the disk). You can think of it as a malware doing process injection, and then deleting itself from the disk, only staying alive within the process that hosts it. As an example, executing a malicious script via PowerShell can be considered fileless.

As for detection, security products have also been able to detect fileless malware for a while now. Powerliks, GootKit and Kovter are examples of fileless malware, according to media's description of the concept.

2

Although Fileless or "in-memory" malware concept is not new, it is now much more frequent and used in large number of attacks. Lenny Zeltser gave a very good overview about it in the following article: "Deconstructing Fileless Attacks into 4 Underlying Techniques".

Technique #1: Malicious Documents

Attacks that many professionals classify as fileless often involve document files. In such scenarios, the adversary supplies the malicious document—typically as an email attachment—for one of the following purposes:

Documents can act as flexible containers for other files. The attacker can embed a JavaScript file in a Microsoft Office document, for instance, and social-engineer the recipient to double-click the embedded file to execute the script. Other document types that can carry files include PDF and RTF. Since this capability is a feature of the respective applications, anti-malware technologies generally don’t interfere with its use. Documents can carry exploits that execute malicious code. The complexity of today’s document features offers a generous attack surface for exploiting vulnerabilities such as parsing bugs. In such scenarios, the exploit can trigger the execution of the bundled shellcode in memory of the compromised application, giving the attacker a foothold on the endpoint even without saving the code to the file system. Documents can execute malicious logic that begins the infection. Modern documents support powerful scripting capabilities, such as Microsoft Office’s ability to execute VBA macros. Such features allow the attacker to implement malicious logic without a compiled executable, taking advantage of the weakness of many anti-malware tools at distinguishing between nefarious and benign scripts. Document script abilities include launching programs and downloading malicious code. Though documents reside on the endpoint’s file system, they offer adversaries an opportunity to avoid placing traditional malicious executables on disk. In many cases, the document leads to the execution of malicious code directly in memory of the endpoint as part of the fileless infection. For an example of how attackers use documents to initiate an attack, see Omri Moyal’s write-up about the misuse of Microsoft Office support for DDE. For another scenario, take a look at the post about attackers inserting themselves into the conversation to spread malware.

Technique #2: Malicious Scripts

Consistent with the objective to avoid compiling malicious code into traditional executables, malware authors rely on scripts during attacks that have fileless attributes. Beyond the scripts supported natively by documents, as mentioned above, the scripts that run directly on Microsoft Windows provide adversaries with the following advantages:

They can interact with the OS without restrictions that some applications, such as web browsers, might impose on the script. They are harder for anti-malware vendors to detect and control than compiled malicious executables. They offer a flexible opportunity to split malicious logic across several processes to evade behavioral detection. They can be obfuscated to slow down analysts and further evade detection by anti-malware technologies. Microsoft Windows includes script interpreters for PowerShell, VBScript, batch files and JavaScript. The tools that attackers invoke to run these scripts include powershell.exe, cscript.exe, cmd.exe and mshta.exe. With the addition of the Windows Subsystem for Linux, Microsoft offers even more scripting technologies on the endpoint.

Technique #3: Living off the Land

Discussions of fileless attacks often include the misuse of the numerous utilities built into Microsoft Windows. These tools allow adversaries to trampoline from one stage of the attack to another without relying on compiled malicious executables. This mode of operation is sometimes called “living off the land.”

Once the adversary’s malicious code can interact with local programs, possibly by starting the infection with a document, the attacker can misuse the utilities built into the OS to download additional malicious artifacts, launch programs and scripts, steal data, move laterally, maintain persistence, and more. The many tools that attackers invoke for these purposes include regsvr32.exe, rundll32.exe, certutil.exe and schtasks.exe. For a comprehensive listing and description of such built-in binaries, libraries and scripts that attackers misuse in this manner see Oddvar Moe’s LOLBAS project.

Windows Management Instrumentation (WMI), built into the OS, offers attackers additional opportunities to live off the land. WMI allows adversaries to interact with most aspects of the endpoint with the help of the wmic.exe executable (and some others) as well as by using scripts (e.g., PowerShell). Since these actions involve only trusted, built-in Windows capabilities, they are difficult for anti-malware technologies to detect and restrict. For a comprehensive explanation of how WMI can assist with fileless attacks, see Matt Graeber’s paper Abusing WMI to Build a Persistent, Asynchronous, and Fileless Backdoor.

Attackers dramatically increase their chances of evading anti-malware tools, including antivirus and application whitelisting measures, by relying on such benign and trusted utilities. For additional examples of such techniques, see Matthew Dunwoody’s overview of APT29’s use of WMI and PowerShell to plant fileless backdoors.

Technique #4: Malicious Code in Memory

While examining files on disk is the strength of many anti-malware products, they often struggle with malicious code that resides solely in memory. Memory is volatile and dynamic, giving malware the opportunity to change its shape or otherwise operate in the blind spot of antivirus and similar technologies.

Once the attacker starts executing malicious code on the endpoint, possibly using the methods outlined above, the adversary can unpack malware into memory without saving artifacts to the file system. This can involve extracting the code into the process’ own memory space. In other cases, malware injects the code into trusted and otherwise benign processes.

Examples of in-memory attack techniques include the following:

Memory injection utilizes features of Microsoft Windows to interact with the OS without exploiting vulnerabilities. For instance, API calls often abused by malware for injection include VirtualAllocEx and WriteProcessMemory, which allow one process to write code into another process. Attackers can wrap compiled executables into scripts that extract malicious payload into memory during runtime. Process Doppelgänging is an example of an approach to avoiding the file system that doesn’t involve memory injection in a classic sense. Instead, the attacker misuses NTFS transaction capabilities built into Microsoft Windows to temporarily modify a trusted file in memory without committing changes to disk. SynAck malware used this evasion technique, as described by Anton Ivanov, Fedor Sinitsyn and Orkhan Mamedov. In-memory techniques allow attackers to bypass many anti-malware controls, including application whitelisting. Though antivirus tools try to catch memory injection, adversaries’ consistent ability to infect endpoints highlights their limitations. Asaf Aprozper’s CoffeeShot tool demonstrates the brittle nature of such detection attempts by implementing an injection method in Java.

2

Fileless malware is not new. However, the advent of newer endpoint monitoring solutions like Crowd Strike, Carbon Black, enSilo, etc. have made use of file-based malware much harder than it used to be. As a result, attackers are emphasizing fileless malware, and therefore you see more articles about it. (And the new solutions attempt to detect fileless malware, in turn.)

[are] those articles are just kind of promoting new cyber solutions?

No, there's definitely an increased emphasis in fileless malware driving conversation, even though it's not a "new" thing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .