Fileless malware
Fileless malware is a significant and evolving category of malicious software known for its stealthy nature and ability to evade traditional security defenses.
Here is a comprehensive explanation of fileless malware, its mechanism, methods, and implications, drawing on the sources:
What is Fileless Malware?
Fileless malware, also known as non-malware, infects legitimate software, applications, and other protocols existing in the system to perform various malicious activities.
- Operation in Memory (RAM): Unlike traditional viruses, fileless malware does not rely on files and often leaves no footprint on the hard drive. It typically executes and resides solely in the system's RAM (Random Access Memory).
- Leveraging Existing Vulnerabilities: This type of malware leverages existing vulnerabilities to infect the system, often exploiting legitimate system tools for execution.
Reasons for Using Fileless Malware
Attackers favor fileless techniques because they offer several advantages in evasion and persistence:
- Stealth in Nature: Fileless malware exploits legitimate system tools, making it extremely difficult to detect, block, or prevent by traditional security measures. It runs malicious code by manipulating elements in the system memory or registry without the need for an executable file on the disk.
- "Living Off the Land" (LoL): This technique exploits tools already installed in the system by default. An attacker avoids creating custom tools, which simplifies the attack and prevents the creation of easy-to-detect custom file signatures.
- Trustworthiness: The system tools used by fileless malware are often highly trusted, leading security tools to incorrectly assume that their use is legitimate.
- Persistence Without Files: Despite not storing files, fileless malware can achieve persistence by injecting malicious code into the registry or scheduling tasks, allowing it to remain active even after a system reboot without leaving traditional forensic evidence.
- Complicating Forensics: The transient nature of fileless malware complicates forensic analysis and incident response because there are no files to analyze, and memory contents can be lost upon system reboot.
Fileless Techniques Used by Attackers
Attackers utilize various methods to deploy and execute fileless payloads:
| Technique | Description and Components |
|---|---|
| Native Applications | Attackers exploit pre-installed tools in operating systems like Windows, such as PowerShell and Windows Management Instrumentation (WMI), to run malicious code. WMI is abused for automation, lateral movement, and persistence. |
| Legitimate Applications | Attackers exploit legitimate system packages like Microsoft Word, Javascript, Flash, Adobe PDF Reader, or other documents. Malicious code is run by injecting the payload into the process memory of these applications. |
| Phishing Emails/Documents | Attackers use phishing to embed malicious links or documents. When the victim opens the email or clicks the link, code is injected directly into memory via scripts embedded in documents or vulnerabilities. |
| Malicious Websites | Fileless threats arrive from exploit-hosting websites. Visiting such a site can automatically scan for vulnerabilities and use Windows native tools (like PowerShell) to download and execute the payload directly into memory. |
| Registry Manipulation | Attackers inject and run malicious code directly from the Windows Registry through a legitimate system process to bypass UAC and application whitelisting. |
| Script-based Injection | Malicious scripts (often obfuscated and encoded) are executed in memory, such as through email attachments containing malicious scripts (VBScript, JavaScript, etc.) which launch the payload without writing files to disk. |
| Memory Code Injection | This technique injects malicious code and maintains persistence in the process memory of a running process (a legitimate system process). |
| Reflective DLL Injection | A dynamic link library (DLL) is loaded entirely into the memory space of a running process without writing the DLL to disk. |
Classification of Fileless Malware
Fileless malware can be categorized based on its entry point and persistence requirements:
| Type | Description |
|---|---|
| Type 1: No File Activity Performed (Hardware) | Malware never writes a file to the disk. Examples include malicious code embedded within compromised device's firmware or memory exploits. |
| Type 2: Indirect File Activity (Execution/Injection) | Malware executes on the target machine using system files indirectly. For example, an attacker can trigger a malicious PowerShell command via the WMI repository. |
| Type 3: Required Files to Operate (Exploit) | Malware requires files to operate but does not execute attacks from those files directly. For example, exploiting a document with an embedded macro or file. |
Examples and Persistence Techniques
- LODEINFO is a fileless malware that uses VBA macros to launch a downloader shellcode, leading to the remote retrieval and execution of malicious macros hosted in the attacker's environment.
- Attackers maintain fileless persistence by exploiting WMI Event Subscription, Scheduled Tasks, and Registry Run keys (Windows Autostart). They can inject payloads into the registry that automatically run upon reboot.
Countermeasures Against Fileless Attacks
To defend against fileless attacks, countermeasures focus on restricting access to the tools and methods attackers abuse:
-
Remove or Restrict Administrative Tools: Remove all administrative tools and restrict access through Windows Group Policy or Windows AppLocker.
-
Disable Native Tools: Disable PowerShell and WMI when they are not in use.
-
Trust Only Signed Binaries: Disable macros and use only digitally signed, trusted macros.
-
Whitelisting: Implement whitelisting solutions (e.g., McAfee Application Control) to block unauthorized applications and code running on the systems.
-
Advanced Detection: Employ security solutions that utilize behavioral analysis and other sophisticated methods (like AI/ML) instead of relying on file signatures.
-
Monitoring: Monitor activity in PowerShell and other scripting engines, and check logs for suspicious activities.