Awesome.
So beyond PowerShell,
what other types of fileless malware or methods are we talking about?
Well, on the operating system, there are installed by default some C# compilers.
So attackers can download source code for their malware or for
their attacks and compile it on the fly.
And yes, depending on how this is done,
there are going to be some files left behind.
If an attacker downloads the actual source code in a file itself,
that file is going to be on there.
If they remove it, there's always the possibility that you can recover it.
However, going back to PowerShell.
There are attackers out there that I've seen that will in their code,
in the PowerShell code,
they download the source code for C# on the fly and
compile it within PowerShell.
There are APIs within PowerShell that you can use to compile things,
to compile C# code.
So it's like combine capabilities.
Exactly.
It combines the capabilities,
and the advantage to the attacker for this is they're not downloading a
binary that an antivirus signature is going to go off of.
They're downloading source code and compiling that source code on the fly.
And if they do it right, it's all in-memory, so it never touches disk.
Antivirus is probably not going to see this.
EDR type tools, they may not see it as well.
So it's a pretty easy way for an attacker to get whatever they
want onto the system and compile it on the fly so there's no
signature in existence for it.
Excellent.
Yeah, so that's even with deep packet inspection,
a lot of that stuff is looking at the serial binary and looking for
a hex code that indicates the MZU when it's an executable and that
kind of thing and then blocks accordingly based on the hex code
that's inside those packets.
In this case, you would not see those executable headers,
you wouldn't see all of these signatures that you normally see for executables.
Instead,
what would be downloaded would be either like a full source code
file or probably just more likely snippets of code,
which there are literally thousands of ways that you can encode strings,
and so it's almost impossible for intrusion detection systems,
or EDR systems,
or anything that's watching all of this to be able to figure out
how to decode everything that's coming down.
So it's very easy for the attackers to hide these snippets
of code and then compile them on the fly.
Not to mention the CPU overhead to decode every single
thing that comes through all the time.
Depending on how it was done, it would be pretty immense.
But one question I have actually is with C#,
I know, so for UNIX, you can readily compile C code on UNIX.
Microsoft, not quite so much,
but C# can be because it includes those libraries natively on the OS.
So is that the main reason that it's not just we're not pulling down C++,
but instead, we're pulling down the C#?
Yeah.
So with a lot of the.
NET libraries that get installed,
there are C# compilers that get installed with them.
They're on the operating system.
They're usually not in a default path,
so you can't just go to a Command Prompt and type csc,
which is one of the compilers, and have it run automatically.
But it's on your operating system, and if you search around for it,
you're going to find it.
There's csc.
exe.
There is another one, microsoft.
workflow.
compiler.
exe.
Searching around on your Windows system, you're going to find it somewhere.
And the nice thing for attackers is that they're
usually in the same directories.
So once you find it and once you know where it is on one system,
it's probably going to be in that same location on all of the other system.
And so the attackers could hard code that address or
that directory where that file is,
and they can go in and compile their code without
having to search the entire hard drive,
which could indicate some activity is going on.
Yeah, so they can evade a CPU usage anomaly or even just an indexer usage.
So with C#,
this isn't stuff that's being brought down for developers on a developer box,
so you can't just kind of segment off this subnet of your DevOps guys who
are doing whatever they want just to make the app work.
This is stuff that comes with the OS in a standard directory.
It doesn't have to be preinstalled by anyone.
Correct.
Yeah, this goes back to living off the land,
which is what the fileless attacks and fileless malware are based off of.
The attackers know that these compilers exist within Windows,
and so they know that they're going to be able to use it,
and they use it to their advantage with every chance that they get.
Awesome.