How Fileless Intrusions Work: The Anatomy of a Stealth Attack

Sun Tzu's description of stealth in the "Art of War" reads almost like a plan for a fileless intrusion. Attackers have been turning to fileless techniques to slip past detection, and it would be easy to suspect that they took the book's advice on staying unseen as their manual.

The reason for concern is plain from two things: what other security experts are saying about these attacks, and the unprecedented number of organisations that have fallen victim to them.

Why fileless attacks are so hard to see

In a fileless attack the intruder stays hidden. The victim has no idea how to clean up the system and, worse, may not realise an attack is happening at all. The attacker therefore remains inside for longer, sometimes permanently, and keeps up the assault. Meanwhile the organisation carries on unaware of the harm being done, and so is in no position to stop it.

Most of these intrusions rely on shellcode, running simple scripts directly in memory. The malicious code usually sits in the registry or in instrumentation management tools. Because the exploit lives in memory or swap space, ordinary antivirus tools struggle to spot it. For criminals, that stealth is the attraction: it lets them sit inside an organisation's defences for long stretches without being noticed. It is little surprise, then, that fileless attacks are growing. Research CrowdStrike carried out at the end of the previous year found that fileless malware and malware-free incidents made up 66% of all attacks.

The stages of a fileless intrusion

Specialists at CrowdStrike describe a distinct anatomy for a fileless intrusion from start to finish.

1. Initial compromise. The attacker typically loads shellcode and activates it in the registry or in instrumentation management tools such as Windows PowerShell or Windows Management Instrumentation (WMI). Injecting shellcode is a favoured method because it exploits vulnerabilities already present in the system to place malicious code in memory. Nothing is written to disk, so traditional anti-malware defences are sidestepped.
2. Command and control. Having taken control of the compromised machine, the attackers generally run shellcode to steal the credentials of the relevant users, then use those credentials to raise their privileges on the system.
3. Persistence. Last, they try to entrench themselves by opening the system up so it can be reached without any access password, which helps them avoid detection and leave no trail.

Set aside the criminal intent and look closely at how these intrusions are put together, and the conclusion is that they are a clever, stealthy way to breach systems. That is exactly what makes them more dangerous.

Staying safe from fileless intrusions, the article argues, depends on understanding the bare structure of these attacks and bringing emotional intelligence to bear in countering them. Practical defences are covered in a separate piece on how to stop hidden fileless threats.