So we're going to be talking about fileless malware,
and really, the first question is is what is fileless malware beyond a buzzword?
So fileless malware is a really a class of malware or attacker
techniques that use operating system commands that are already
installed in the operating system.
The attackers live off the land.
And while fileless malware sounds like it doesn't leave behind any files at all,
that's really a misnomer.
There are often files that are left behind by the
malware or used in the attacks.
There are very few attackers or malware that leave no files left behind at all.
Yeah, so there's not much that doesn't leave some sort of artifact,
and that's how we can hunt for it.
They're going to use the tools that are installed in the system like PowerShell,
the C# Compiler, living in the registry,
and other techniques like that to maintain persistence on the
system and really just hide from the defenders.
So these are tools that have to be enabled or are already enabled so
you can make system administration a little easier.
I know I used PowerShell all the time when I was in my
comeuppance in system administration and automation,
and you can't really disable that and still be able to manage your environment,
but then the attacker can also use that.
Exactly.
You know, all of the tools, like PowerShell,
WMI,
that the systems administrators use to manage all
the systems within an enterprise,
the attackers are using those to their advantage.
So it becomes very difficult for the defenders to both find that activity out
of all of the noise that's happening from the normal systems administration
and hone in on what the malicious activity is.
Talking about that, maybe give me an example.
Sure.
So the classic example is a user surfing the web,
and they click on the wrong link and go to a malicious site that
loads up let's say a malicious flash file.
It's always flash.
And instead of the flash file downloading additional malware where it
would be actually downloading a file onto the system.
Instead, it runs, let's say, a PowerShell command.
And that PowerShell command in turn goes out,
downloads something from the internet from another malicious site,
but instead of dropping it to the disk,
it actually just loads it directly into memory,
and so the malware is now running in-memory.
It's never touched the disk,
and that malware that's running in-memory may store
itself directly in the registry.
And yeah, the ones who really know what's going on are going to say well,
the internet cache has files in it, the registry is technically a file,
but the malware itself has never really touched the disk.
That's where the fileless malware name comes from.
Yeah, that's what the moniker fileless malware is.
It's not that there are no files involved or there's no artifacts involved.
It's that the stuff streams directly in-memory and that the
malicious part is deobfuscated memory,
and then it is really difficult for things to detect.
The malicious part never touches disk, and so some of the traditional tools,
like antivirus,
that may have a tougher time seeing things in-memory or seeing things that
are getting injected into other processes on it within Windows are going
to have more a difficult time to find that.
And as analysts and investigators,
when we go in to start looking to see why is this system acting weird,
we typically look at timelines, and disk forensics,
and things along those lines.
That won't work in these cases because, like I said,
there's no malware on the disk.
It's all in-memory or it's all being hidden in the registry or other places,
so we have to use different techniques.
So you have to look for how it established persistence,
if it established persistence,
or use other tangential information to kind of identify
something is going on weird with the system.
Exactly.
I like that you said weird.
So like that's kind of a common security operations
incident response word that I like to use.
It's not always a signature analysis or like a AV sig.
It isn't always going to work.
We need to look for things like what's weird is really,
pretty much describes my job.
Oh yeah.
That is absolutely it.
I mean, when we talk about hunting, hunting has been around for years and years.
It's just kind of become that buzzword within the last couple years,
but it all stems down to that analysist sitting there
watching things that are going on and go hmm,
that looks a little odd.
Let me look into that a bit more.
And that's what you really have to do in these cases.
You have to look for those anomalies.
You have to look at your tools.
Antivirus does a--- antivirus is antivirus.
It's going to do the best it can.
ERD system, endpoint detection and response systems,
tend to work a little bit better with detecting fileless malware
just because they're looking for those anomalies.
They're helping us find those anomalies that are
occurring on the systems as they run.
So we get a little bit into behavior analysis where we're essentially
playing the one of these things is not like the other game.
Establish the baseline and find what's weird.
Exactly.
So are we going to, in this course,
we're probably going to take a look at some examples?
Yeah, we're going to look at how does fileless malware work.
We'll show you a couple examples of how they work.
I've got a couple systems here that I've already
compromised with fileless malware,
and so we'll go in and we'll look and see how we can
detect it and what we need to do to Windows in order to
actually find this type of thing.