Detecting Fileless Malware Techniques

When to Use

• EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32)
• Investigating attacks that leave no traditional malware files on disk
• Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence
• Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments
• Memory forensics reveals malicious code but no corresponding files exist on the filesystem

Do not use for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.

Windows Defender / Antivirus False Positive

Some endpoint antivirus products — notably Windows Defender (signature Trojan:script/Wacatac.H!ml) — may quarantine this skill's SKILL.md as malicious. This is a known false positive: the file intentionally documents fileless attack patterns (LOLBins, encoded PowerShell, memory YARA indicators) for defensive detection and investigation. The content is educational only; it does not execute code.

If quarantined: restore the file from quarantine, add an exclusion for your local agent skills directory, and see GitHub issue #100 for discussion. YARA strings live in references/yara-fileless-powershell.yar (not inline in this file) to reduce scanner triggers while preserving the rule for analysts.

Prerequisites