So we've talked a little bit about how these things work,
these fileless malware attacks, and we gave an example in the last module,
and then we've also talked kind of briefly about why attackers would
use these because they can evade different things,
but really, there's a bunch of ways to attack a system,
or there's a bunch of different methods of exploits that malware uses.
Why is this becoming so prevalent?
Well, it really comes down to the fact that it's difficult to detect.
The logging that is turned on on Windows systems by default,
and unfortunately, most organizations, they don't turn logging on,
or they don't enhance logging much past the defaults.
And so a lot of this is not being logged,
a lot of this activity is not being logged,
and so these techniques become stealthy for the attackers.
I mean, not only that, if you're living off the land,
if you're using PowerShell, and you're using WMI,
and you're using the tools that are already installed on the system,
that means you don't have to download additional tools,
which means you have less of a footprint on the system and on the network.
It means that you know that the tools are already there.
It's very easy for you to test because as an attacker,
if I was going to attack an organization,
I want to test my tools out beforehand,
and if they have some custom Windows image,
that means that my malware may not work like I expect it too.
But if I use PowerShell,
I know that the PowerShell on my computer is probably going to
be the same PowerShell as on your computer.
And so if I test it on my computer and it works,
it's probably going to work on yours as well.
Yeah, because it's part of the base OS.
It's not like a third-party software that has to be enabled like a lot of the
lower CVSS stuff that's coming out now that's like if this,
and this, and this, then this exploit works whereas this is,
yeah, it's on every single system and definitely going to be usable.
Yeah, that's interesting.