Skip to main

Fileless Threats Protection

Fileless threats don’t store their bodies directly on a disk, but they cannot bypass advanced behavior-based detection, critical area scanning and other protection technologies.

Fileless malware is malware that does not store its body directly onto a disk. This type of malware became more popular in 2017 because of the increasing complexity of its detection and remediation. Although such techniques were limited to targeted attacks in recent years, today they proliferate more and more in the current threat landscape, and Kaspersky Lab registers new families of trojan-clickers or even adware with fileless components.

The following fileless techniques are broadly used in attacks:

  • Malicious script stored in Windows Management Instrumentation subscription (WMI)
  • Malicious script directly passed as command line parameter to PowerShell
  • Malicious script stored in registry and/or OS scheduler task, and executed by OS scheduler
  • Malicious executable extracted and executed directly in memory without saving on disk via .Net reflection technique
  • And others

Threat actors deliver fileless payloads to a victim’s machine via the following methods:

  1. Vulnerability exploitation
  2. Malicious document with macros
  3. Simple executable file

The following are examples of how legitimate applications are used to execute malicious scripts which are not stored on a disk. These techniques used for their persistence approach, become a true challenge for security solutions.

Executing malicious script with the help of mshta application

Using rundll32 application to execute malicious javascript script

Example of malicious WMI subscription

As part of its multi-layered, next generation protection, Kaspersky Lab offers several components that help to detect and protect from fileless threats:

  • Threat Behavior Engine , contains components of
    1. Behavior detection
    2. Remediation Engine
    3. Exploit Prevention (EP) to prevent on stage of exploitation
  • Engine for scanning critical areas (including tasks in OS Scheduler, Windows Management Instrumentation subscriptions (WMI), registry, etc.

  • Behavioral analysis allows efficient detection of fileless threats on execution stage. Behavior-based heuristics are analyzing execution patterns of any process in the system (including legitimate utilities) to detect attempts to perform malicious actions.

    Among other examples of such heuristics is the analysis of command line parameters of executed process and the context of execution:

    • The parent process of executed application (office application, script host, etc)
    • What activity was on system prior to execution
    • Were there any probable suspicious activity on the system (strange network activity, application crash, strange URL request, etc)
    It is also helpful to take advantage of technologies embedded into OS Windows, such as Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) used in role of event sources.

Related Products

Kaspersky Anti Targeted Attack Platform

Proven advanced threat detection empowered by machine learning and HuMachine™ intelligence

Kaspersky Endpoint Security for Business

The leading multi-layered endpoint protection platform based on Next Gen cybersecurity technologies.

Kaspersky Small Office Security

Kaspersky Small Office Security protects more of the things that matter to your business – including your money, identity & confidential customer information.

Kaspersky Anti Ransomware Tool

Don’t get held to ransom! Protect your business today!

Kaspersky Security for Virtualization

Protect your virtual infrastructure

Kaspersky Anti-Virus

Safeguards your PC and all the precious things you store on it

Kaspersky Internet Security

Helps protect every aspect of your digital life – on PC, Mac & Android

Kaspersky Total Security

Gives you a smarter way to protect your family – on PC, Mac, Android, iPhone & iPad

Operation Daybreak

Fileless attacks against enterprise networks

Related Technologies

Behavior Analysis

Behavior Monitoring with Memory Protection provide the most efficient ways to protect against advanced threats and zero-day malware.

Exploit Prevention

Exploit Prevention (EP) protects against malware that takes advantage of software vulnerabilities.

Machine Learning

ML-based technologies are used in both products and infrastructure.


Ransomware protection on both delivery and execution stages by technologies from Multi-layered protection stack