How fileless malware works
Attackers typically gain initial access through phishing, a malicious document or an exploited vulnerability. They then run commands through trusted tools already present on the system, loading payloads directly into memory or storing scripts in places such as the registry or scheduled tasks.
This technique is often called living off the land. Since the tools involved are legitimate, defenders must watch for unusual use, such as an Office document spawning PowerShell with encoded commands. Reboots may remove the in-memory code, so attackers often add persistence. Persistence may rely on registry run keys, WMI event subscriptions or scheduled tasks that relaunch the in-memory payload after a restart, giving defenders something to find.
Why it matters for Canadian organizations
Traditional antivirus relies heavily on scanning files, which leaves a gap that fileless techniques are designed to exploit. Intrusions using these methods can persist unnoticed while attackers move through the network and reach sensitive data.
The Canadian Centre for Cyber Security encourages organizations to monitor and restrict administrative tooling. Undetected intrusions can lead to breach notification obligations under PIPEDA and Quebec Law 25 once personal information is affected. Memory-only code can still be observed through process injection, unusual parent-child process relationships and network beacons, which good endpoint telemetry records even without a file.
How to defend against it
Deploy endpoint detection and response that analyzes process behaviour, command lines and memory. Turn on script logging for PowerShell and forward the logs to a central platform for analysis.
Reduce what attackers can abuse: restrict scripting tools to those who need them, use application control, disable unneeded macros, and patch promptly. Train staff to recognize phishing, the most common delivery route. Incident responders should capture memory before rebooting a suspect system, since a restart may erase the evidence needed to understand what ran.
Frequently asked questions
Is fileless malware really fileless?
Mostly, but not entirely. The payload runs in memory or via legitimate tools, yet the initial delivery often involves a file such as a document, and persistence mechanisms may leave traces in the registry or scheduled tasks. The term describes minimal on-disk executables.
Can antivirus detect fileless malware?
Traditional signature-based antivirus struggles, because there is often no malicious file to scan. Behaviour-based tools such as EDR, along with script logging and memory analysis, are far more effective at spotting the unusual activity these attacks produce.
What is living off the land?
Living off the land means attackers use legitimate tools already on a system, such as PowerShell, WMI or built-in utilities, instead of bringing their own malware. This helps them blend in with normal administration and avoid file-based detection.
Related service: Cyber defense