skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-fileless-malware-techniques

Detects fileless malware using memory forensics, WMI analysis, and LOLBin abuse detection patterns.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#threat detection#memory forensics#Volatility#lolbins#wmi persistence#fileless malware
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-fileless-malware-techniques
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-fileless-malware-techniques
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/malware-analysis/detecting-fileless-malware-techniques
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-fileless-malware-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Fileless malware operates entirely in memory or within legitimate system tools, leaving no executable files on disk, which defeats traditional file-based antivirus scans, hash lookups, and static triage. This Skill provides a structured detection and investigation workflow for these in-memory threats.

Core Features & Use Cases

  • LOLBin Abuse Detection: Identifies malicious use of legitimate Windows binaries like mshta, regsvr32, certutil, rundll32, and wmic based on suspicious argument patterns rather than binary names.
  • WMI Persistence Analysis: Enumerates WMI event filters, consumers, and bindings via Sysmon Event IDs 19/20/21 and direct namespace queries to uncover fileless persistence mechanisms.
  • Memory & Registry Forensics: Uses Volatility 3 (malfind, YARA scans) and registry scanning to find reflectively loaded .NET assemblies and Base64-encoded payloads stored in registry values.
  • Use Case: An EDR alert shows powershell.exe spawning from mshta.exe with no malware files on disk. Use this Skill to trace the LOLBin chain, extract the WMI persistence consumer, decode the Base64 payload, and produce a full attack-chain report with IOCs and MITRE ATT&CK mappings.

Quick Start

Investigate the suspicious PowerShell and WMI activity on this Windows host and determine whether fileless malware is present.

Frequently Asked Questions about detecting-fileless-malware-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect fileless malware on Windows?▼

Detect fileless malware by analyzing behavior rather than files: review process lineage, PowerShell Script Block Logging (Event ID 4104), and Sysmon process-creation events. Use Volatility 3 malfind and YARA scans on memory dumps to confirm in-memory payloads.

How to detect WMI event subscription persistence?▼

Enumerate the root\subscription namespace for __EventFilter, CommandLineEventConsumer, ActiveScriptEventConsumer, and __FilterToConsumerBinding instances. Sysmon Event IDs 19, 20, and 21 capture filter, consumer, and binding creation if logging was enabled before the incident.

What are LOLBins and how are they abused?▼

LOLBins are legitimate Windows binaries like mshta, regsvr32, certutil, and wmic that attackers abuse to execute malicious code while evading application whitelisting. Detection focuses on suspicious argument patterns such as certutil -urlcache or regsvr32 /i:http rather than the binary name.

Does memory forensics work after a system reboot?▼

No, in-memory-only malware stages vanish on reboot, so capture a RAM dump before remediation. Registry-stored payloads and WMI subscriptions survive restarts and can be decoded offline for analysis.

When should I not use fileless malware detection techniques?▼

Do not use these techniques for traditional disk-resident malware, where standard static and dynamic analysis methods are more appropriate. Also note that legitimate SCCM, Intune, and GPO logon scripts use the same LOLBins, so validate decoded commands before flagging.

Related Skills

Explore More Software Engineering Skills→
emilneuraz-aiemilneuraz-ai

memory-forensics

Extract processes, network connections, and artifacts from RAM dumps with Volatility 3.

Community
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
OpenTideHQOpenTideHQ
4

network-protocols

Explain network protocol internals for detection engineering across DNS, TLS, SMB, and more.

Official
Advanced
SherifEldeebSherifEldeeb
5

memory-forensics

Analyze volatile memory dumps for malware and rootkits using Volatility 3.

Community
Advanced