How to Defend Against Fileless Attacks That Antivirus Cannot See

A fileless attack gets into a system without ever writing malware to the hard disk. It is a collection of techniques rather than a single piece of code, and because nothing lands on disk, heuristic scanners such as antivirus (AV) applications have nothing to catch. The damage these attacks cause has been compared to that of a tsunami, and they are becoming more common. Research by the Ponemon Institute put the share of attack techniques that are fileless at almost 77%.

Why these attacks are so hard to catch

Much of what makes fileless attacks slippery is where they hide: in shellcode and in registries, places defenders rarely think of as dangerous. An attacker who uses tools already present on the machine, or who runs short pieces of shellcode and scripts, can chain the steps together and finish within seconds. When that time to execute, the 'delta T', is close to zero, the harm can be neither undone nor contained.

The Calicum/Fin7 group's campaign against restaurants in the United States in late 2017 was the first large fileless malware attack, and it shook the security community. Activity has not eased since. SentinelOne's Enterprise Risk Index Report for the first half of 2018 recorded a 94% rise in fileless attacks. It also found that 70% of all detections were unknown to antivirus software, meaning the AV products had no idea the systems they were meant to guard had already been compromised.

Practical ways to reduce the risk

The method is straightforward: stay out of sight and get in through shellcode and registry entries. Knowing how the attack works is also what makes a defence possible. Several practical measures help, including a clear picture of the organisation's application inventory, blocking exploits, and an attack behaviour analysis tool that hunts proactively for malicious activity.

These measures depend on a complete protection platform, and to keep costs sensible it should ideally be cloud-native. The sponsored post gives the cloud-native CrowdStrike Falcon platform as an example. It brings the essential security functions together with next-generation techniques such as machine learning, behavioural analytics and continuous monitoring, aimed at the most sophisticated fileless attacks.

The insider problem

A breach is usually assumed to come from outside attackers. In practice, most breaches begin inside the organisation, and insiders matter a great deal in fileless attacks because they already hold easy, privileged access to critical systems. Human weaknesses make identity hijacking simple, so a trusted colleague in the finance department can in effect become the attacker's instrument, and that hijacked identity then opens the door to a fileless attack.

One way around insider breaches is a platform with next-generation features such as global threat intelligence and sandboxing. A sandbox gives the attacker a separate, restricted environment to go after, so the intrusion hits the decoy and leaves the real production systems untouched. It is a neat way to, as the saying goes, "hit the snake without breaking the stick". CrowdStrike's platform includes these capabilities, among others, for detecting malware and fileless attacks, preventing intrusions and responding quickly to incidents as they unfold.