skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-fileless-attacks-on-endpoints

Detects fileless malware and in-memory attacks using Sysmon, PowerShell logging, and AMSI telemetry.

954|172|Updated Mar 13, 2026
Search Tags:#endpoint security#sysmon#powerShell#detection engineering#amsi#wmi persistence#fileless malware
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-fileless-attacks-on-endpoints
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-fileless-attacks-on-endpoints
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/detecting-fileless-attacks-on-endpoints
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-fileless-attacks-on-endpoints

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Fileless malware executes entirely in memory without writing files to disk, so traditional antivirus finds nothing. This Skill provides detection rules, telemetry configuration steps, and validation procedures to surface PowerShell abuse, reflective DLL injection, WMI persistence, and registry-resident malware on Windows endpoints.

Core Features & Use Cases

  • Telemetry Enablement: Step-by-step configuration of PowerShell Script Block Logging, Module Logging, Transcription, and Sysmon event IDs 1, 7, 8, 10, 13, and 19-21.
  • Detection Rules: Ready-to-use queries for encoded PowerShell commands, download cradles, AMSI bypass attempts, process injection, WMI event subscriptions, and registry-based execution, including Splunk and MDE KQL examples.
  • Validation Workflow: Atomic Red Team test cases (T1059.001, T1620, T1546.003) to confirm detections actually fire and reach the SIEM.
  • Use Case: A SOC analyst investigating an incident where AV found no malicious files uses this Skill to hunt for in-memory indicators and build durable detections against living-off-the-land techniques.

Quick Start

Use this skill to build detection rules for fileless PowerShell attacks and validate them with Atomic Red Team tests on my Windows endpoints.

Frequently Asked Questions about detecting-fileless-attacks-on-endpoints

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect fileless malware on Windows endpoints?▼

Detect fileless malware by enabling Sysmon events 1, 7, 8, 10, and 19-21 plus PowerShell Script Block Logging (Event ID 4104). Then alert on encoded commands, download cradles, reflective image loads from non-standard paths, and WMI event subscriptions.

How to detect malicious PowerShell commands with Sysmon and logging?▼

Enable Script Block Logging machine-wide under HKLM and monitor Event ID 4104 for patterns like IEX, DownloadString, FromBase64String, and AMSI bypass strings. Correlate with Sysmon Event ID 1 for encoded command lines using -enc or -encodedcommand.

Why is PowerShell Script Block Logging not capturing events?▼

Script Block Logging must be set machine-wide under HKLM, not HKCU, and only applies to PowerShell v5 and later. Attackers can evade it with a powershell -version 2 downgrade, so verify 4104 events appear for a known test script before trusting clean results.

Can AMSI bypass attempts be detected?▼

Yes, AMSI bypass attempts appear in Event ID 4104 script blocks containing strings like AmsiUtils, amsiInitFailed, or [Ref].Assembly.GetType. An abrupt halt in script-block events is also suspicious, since ETW patching suppresses logging.

What Sysmon event IDs detect WMI persistence?▼

Sysmon Event IDs 19, 20, and 21 capture WMI event filter, consumer, and filter-to-consumer binding activity. Many default Sysmon configs omit these, so confirm they are enabled and enumerate __FilterToConsumerBinding objects under root\Subscription.

When should this detection approach not be used?▼

This approach targets fileless and in-memory attacks, not file-based malware or malware reverse engineering. It also requires Sysmon, PowerShell logging, AMSI, and an EDR to be deployed first, since the detections depend entirely on that telemetry.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced
YukiIto1999YukiIto1999

performing-endpoint-forensics-investigation

Identify and document endpoint compromises through Windows digital forensics investigations.

Community
Advanced
anavvanzinanavvanzin

agency-threat-detection-engineer

Author Sigma rules, map to MITRE ATT&CK, and deploy via CI/CD to SIEMs.

Community
Advanced
bingookbingook

memory-forensics-volatility

Analyze memory dumps with Volatility 2 and 3 for malware detection.

Community
Advanced