Fileless malware

Runs in memory via PowerShell or WMI without writing binaries

categoryMalwareseverityHighdetectability (measured in our lab)Highlabdetected in lab

Example: Astaroth

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1059.001 · PowerShell Command Execution · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059.001 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1059.001 -TestGuids a538de64-1c74-46ed-aa60-b995ed302598 -TimeoutSeconds 120'

ATT&CK T1059.001 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059.001 -Tool atomic -RunId run-2026-10-14-018 -Command 'Invoke-AtomicTest T1059.001 -TestGuids a538de64-1c74-46ed-aa60-b995ed302598 -TimeoutSeconds 120'

ATT&CK T1059.001 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1059.001 -Tool atomic -RunId run-2026-10-18-019 -Command 'Invoke-AtomicTest T1059.001 -TestGuids a538de64-1c74-46ed-aa60-b995ed302598 -TimeoutSeconds 120'

+ 3 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-11-02

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell executed "Get-Content -Stream or Invoke-Expresion". Possible string execution as code
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
… and 4 more event type(s)

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100405 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~4976 incidental alerts/hour — tune against this.

detected windows · 2026-10-27

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell.exe spawned a powershell process which executed a base64 encoded command
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
… and 4 more event type(s)

Plus 14 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100405 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~69252 incidental alerts/hour — tune against this.

Classification

32 values: 2 lab-measured, 16 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Malware
Reach (CVSS)	Local
Attack complexity	High
Privileges required	Low
User interaction	Active
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Established

Impact & scope

Severity	High
Impact	ConfidentialityIntegrity
Platform	LinuxmacOSWindows
Environment	On-premises
Target asset class	Endpoint
Kill-chain phase (tactic)	ExecutionStealth
Remote support	No

Detection & telemetry

Detectability (measured in our lab)	High
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Command ExecutionModule LoadOS API ExecutionProcess AccessProcess CreationProcess MetadataScript Execution
Defense bypassed	Anti-virusApplication control

Detection & response

Mitigated by 22

M1026 attack-mitigation
M1038 attack-mitigation
M1042 attack-mitigation
M1045 attack-mitigation
M1049 attack-mitigation
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-DA d3fend
D3-DF d3fend
D3-EAL d3fend
D3-EDL d3fend
D3-EFA d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-PSEP d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-SAOR d3fend

Detected by 227

DET0300 attack-detection-strategy
DET0455 attack-detection-strategy
00ca75ab-d5ce-43be-b86c-55ff39c6abfc sigma
0152550d-3a26-4efd-9f0e-54a0b28ae2f3 sigma
02030f2f-6199-49ec-b258-ea71b07e03dc sigma
02773bed-83bf-469f-b7ff-e676e7d78bab sigma
03d83090-8cba-44a0-b02f-0b756a050306 sigma
056c7317-9a09-4bd4-9067-d051312752ea sigma
058f4380-962d-40a5-afce-50207d36d7e2 sigma
07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb sigma
092bc4b9-3d1d-43b4-a6b4-8c8acd83522f sigma
09576804-7a05-458e-a817-eb718ca91f54 sigma
0a74c5a9-1b71-4475-9af2-7829d320d5c2 sigma
0adfbc14-0ed1-11eb-adc1-0242ac120002 sigma
0c718a5e-4284-4fb9-b4d9-b9a50b3a1974 sigma
0e9e6c63-1350-48c4-9fa1-7ccb235edc68 sigma
0f0450f3-8b47-441e-a31b-15a91dc243e2 sigma
0fdc7c7f-c690-4217-9ae3-31f5156eed72 sigma
1139d2e2-84b1-4226-b445-354492eba8ba sigma
11b52f18-aaec-4d60-9143-5dd8cc4706b9 sigma
13acf386-b8c6-4fe0-9a6e-c4756b974698 sigma
1412aa78-a24c-4abd-83df-767dfb2c5bbe sigma
14bcba49-a428-42d9-b943-e2ce0f0f7ae6 sigma
16b37b70-6fcf-4814-a092-c36bd3aafcbd sigma
175997c5-803c-4b08-8bb0-70b099f47595 sigma
1816994b-42e1-4fb1-afd2-134d88184f71 sigma
18988e1b-9087-4f8a-82fe-0414dce49878 sigma
19d65a1c-8540-4140-8062-8eb00db0bba5 sigma
1a0a2ff1-611b-4dac-8216-8a7b47c618a6 sigma
1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df sigma
1ac8666b-046f-4201-8aba-1951aaec03a3 sigma
1b9dc62e-6e9e-42a3-8990-94d7a10007f7 sigma
1c2a3268-3881-414a-80af-a5b313b14c0e sigma
1cfac73c-be78-4f9a-9b08-5bde0c3953ab sigma
1f21ec3f-810d-4b0e-8045-322202e22b4b sigma
1f49f2ab-26bc-48b3-96cc-dcffbc93eadf sigma
20e5497e-331c-4cd5-8d36-935f6e2a9a07 sigma
21f9162c-5f5d-4b01-89a8-b705bd7d10ab sigma
222720a7-047f-4054-baa5-bab9be757db0 sigma
243de76f-4725-4f2e-8225-a8a69b15ad61 sigma
… and 187 more in the database

Tested by 25

06a220b6-7e29-4bd8-9d07-5b4d86742372 atomic
0d181431-ddf3-4826-8055-2dbf63ae848b atomic
114c2b95-d992-4c03-8c38-fc58420a3eb5 atomic
1289f78d-22d2-4590-ac76-166737e1811b atomic
1c0a870f-dc74-49cf-9afc-eccc45e58790 atomic
388a7340-dbc1-4c9d-8e59-b75ad8c6d5da atomic
4099086c-1470-4223-8085-8186e1ed5948 atomic
4396927f-e503-427b-b023-31049b9b09a6 atomic
49eb9404-5e0f-4031-a179-b40f7be385e3 atomic
56b9589c-9170-4682-8c3d-33b86ecb5119 atomic
686a9785-f99b-41d4-90df-66ed515f81d7 atomic
6a5b2a50-d037-4879-bf01-43d4d6cbf73f atomic
7c1acec2-78fa-4305-a3e0-db2a54cddecd atomic
7c3e0b89-09e6-4f3c-a1e8-1c1dfa9288ce atomic
86a43bad-12e3-4e85-b97c-4d5cf25b95c3 atomic
8a2ad40b-12c7-4b25-8521-2737b0a415af atomic
8e5c5532-1181-4c1d-bb79-b3a9f5dbd680 atomic
999bff6d-dc15-44c9-9f5c-e1051bfc86e1 atomic
a21bb23e-e677-4ee7-af90-6931b57b6350 atomic
a538de64-1c74-46ed-aa60-b995ed302598 atomic
af1800cf-9f9d-4fd1-a709-14b1e6de020d atomic
bf8c1441-4674-4dab-8e4e-39d93d08f9b7 atomic
cc50fa2a-a4be-42af-a88f-e347ba0bf4d7 atomic
f3132740-55bc-48c4-bcc0-758a459cd027 atomic
fa050f5e-bc75-4230-af73-b6fd7852cd73 atomic

Attack relationships

Parent: Living off the land (LOTL/LOLBins)

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-018`	detected	atomic	windows	2026-10-14
`run-2026-10-18-019`	detected	atomic	windows	2026-10-18
`run-2026-10-27-013`	detected	atomic	windows	2026-10-27
`run-2026-11-02-005`	detected	atomic	windows	2026-11-02

run-2026-10-14-018 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=22). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=14 max_level=15 dwell_s=90
run-2026-10-18-019 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=22). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=5 incidental=1488 max_level=15 dwell_s=90
run-2026-10-27-013 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=22). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=5 incidental=1789 max_level=15 dwell_s=90
run-2026-11-02-005 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=22). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1059.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=7 incidental=141 max_level=15 dwell_s=90

Framework references

Primary source: https://www.crowdstrike.com/en-us/cybersecurity-101/malware/types-of-malware/
attack: T1620 (primary)
attack: T1059.001

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 99 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1620, attack:T1059.001 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 233 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 32 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-018 (detected): Wazuh rule(s) 92057 fired on T1059.001 within the detonation window
Powershell.exe spawned a powershell process which executed a base64 encoded command
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-019 (detected): Wazuh rule(s) 91822, 92057 fired on T1059.001 within the detonation window
Powershell script used "Invoke-command" cmdlet to execute sub script
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-013 (detected): Wazuh rule(s) 91822, 92057 fired on T1059.001 within the detonation window
Powershell script used "Invoke-command" cmdlet to execute sub script
ev-0008 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-005 (detected): Wazuh rule(s) 91822, 91837, 92027 fired on T1059.001 within the detonation window
Powershell script used "Invoke-command" cmdlet to execute sub script