Simple definition
Fileless malware describes malicious activity relying heavily on memory or existing components, with little or no dropped executable payload.
Purpose and use
Attackers seek to carry out actions while reducing some disk indicators and using mechanisms already available on the machine.
How does it work?
Scripts, interpreters and configuration stores may contribute to the scenario. The term does not mean that logs or disk artifacts are entirely absent.
Key points
- Example: an interpreter launched in an unusual context generates suspicious network connections and configuration changes.
- Correlate process ancestry, script logs and network events to reconstruct the activity.
Points to watch
PowerShell or a script is not by itself evidence of an attack. Intent, arguments, origin and authorization require analysis.
In short
Fileless describes an execution or storage approach, not a complete absence of evidence.