Fileless malware exposes the limits of antivirus and EDR

At a glance

What this is: This is an analysis of why fileless malware can evade antivirus and basic EDR, with the key finding that memory-resident attacks and living-off-the-land tradecraft are missed when detection depends on files and isolated alerts.

Why it matters: It matters because many identity and endpoint programmes still assume tool coverage equals control coverage, when attackers can abuse trusted processes, valid credentials, and administrator tooling to bypass that assumption.

By the numbers:

• According to Blackpoint Cyber’s 2026 Annual Threat Report, Blackpoint’s SOC detected and responded to threats before traditional EDR agents alerted 72% of the time.

Context

Fileless malware is an execution model, not a file type. The attacker uses memory-resident code and legitimate built-in tooling, which means conventional file scanning and signature matching are looking at the wrong layer of control. For identity and access programmes, the real issue is that trusted admin tools and valid credentials can become the transport mechanism for malicious activity.

The gap is partly technical and partly operational. Endpoint tooling can generate telemetry, but without disciplined behavioural analysis and around-the-clock human review, suspicious sequences blend into normal administration. That makes this topic relevant to IAM and PAM teams as well as endpoint defenders, because the same trust assumptions that legitimise admin work also give attackers room to operate.

Blackpoint Cyber’s framing is typical of environments where security teams equate deployment with coverage. The starting position is common, but the control model is incomplete when memory activity, living-off-the-land techniques, and off-hours response are not part of the design.

Key questions

Q: What fails first when fileless malware runs inside trusted admin tools?

A: The first failure is the assumption that file presence equals risk presence. Fileless malware uses memory-resident execution and legitimate tools such as PowerShell or WMI, so controls that depend on signatures or quarantining executables never see the core attack. Defenders have to inspect behaviour, process chains, and context instead of waiting for a malicious file.

Q: Why does fileless malware create an alerting problem rather than just a detection problem?

A: Because many tools can generate alerts, but alerts only help if someone interprets and acts on them quickly. Fileless campaigns often look like ordinary administration until several actions are linked together, so a queue of isolated events creates delay. The risk rises when response is not continuously staffed and analysts cannot contain the activity in time.

Q: What do security teams get wrong about PowerShell and WMI abuse?

A: They often treat those tools as the problem to block instead of the channel to govern. PowerShell and WMI are legitimate management utilities, so blanket blocking breaks administration. The better approach is to detect suspicious invocation patterns, encoded commands, unexpected parent processes, and sequences that point to attacker tradecraft rather than routine operations.

Q: How should teams respond when valid credentials are used in a fileless attack?

A: They should treat the incident as an identity and access event, not only an endpoint event. Valid credentials let an attacker bypass delivery controls and behave like an authorised user, so containment should include credential revocation, session review, privilege reduction, and checks for lateral movement from the same account.

Technical breakdown

Why fileless malware bypasses file-based detection

Fileless malware executes in memory rather than dropping an executable to disk. That means antivirus, which relies heavily on file signatures, hashes, and known artefacts, has little or nothing to inspect. The attacker instead borrows legitimate tools already present on the endpoint, such as PowerShell, WMI, and Office macros. Because those tools are signed, expected, and widely used by administrators, their presence does not look suspicious on its own. The security problem is not just stealth. It is that the malicious activity is routed through normal operating behaviour, so the defender has to infer intent from context rather than from an obvious malicious file.

Practical implication: detection has to shift from file inspection to behavioural telemetry and sequence analysis.

Living-off-the-land turns trusted administration into an attack path

Living-off-the-land means using approved tools, libraries, and management interfaces to carry out malicious actions. In this article, the main examples are PowerShell, WMI, Command Prompt, and registry Run Keys. These are valuable to attackers because they already exist, are usually allowed, and often sit inside allowlists and management workflows. The result is a control inversion: the same utilities used for remote management, scripting, and persistence can be used to blend in, stage payloads, and keep access alive. That is why detection quality depends on understanding command sequences and process ancestry, not just whether a tool was executed.

Practical implication: correlate scripting, remote management, and persistence activity as a chain, not as separate alerts.

Why telemetry alone is not the same as detection

The article draws a sharp line between visibility and response. Many EDR products can log an encoded PowerShell command or a suspicious child process, but logging is not equivalent to recognising an attack. Fileless campaigns are often only apparent when several ordinary events are analysed together, such as a document launching a script, network calls to an unfamiliar domain, and subsequent access to credentials or lateral movement tools. Without a human or a tightly tuned behavioural model to make that judgement quickly, the incident stays in the queue while the attacker advances. This is where off-hours coverage becomes a control requirement, not a service preference.

Practical implication: pair endpoint telemetry with real-time triage and containment authority.

Threat narrative

Attacker objective: The attacker wants to gain durable access, harvest credentials, and move or exfiltrate data while remaining invisible to file-centric controls.

1. Entry occurs through malicious Office macros, phishing-triggered scripts, exploited remote access tools, or compromised credentials that let the attacker use trusted administration paths.
2. Credential abuse and living-off-the-land execution let the attacker run PowerShell, WMI, or other approved tools directly in memory without leaving a file to scan.
3. The campaign then expands through persistence mechanisms such as registry Run Keys or through lateral movement and credential theft using the same trusted tooling.
4. Impact appears as unattended persistence, credential exposure, or staged exfiltration that conventional file-based controls fail to stop in time.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Fileless malware is really a trust-assumption problem. The attack works because defenders still privilege the presence of a file, a hash, or an executable as the primary signal of risk. Once execution shifts into memory and uses pre-approved tools, those signals lose much of their value. The practical conclusion is that endpoint and identity teams need a control model that treats trusted tooling as potentially hostile when the sequence is wrong.

Behavioural detection is the only durable answer to living-off-the-land abuse. PowerShell, WMI, macros, and command-line tools are not the problem by themselves. The problem is that attackers can combine them into a tradecraft sequence that looks routine until the outcome is already underway. This is a classic detection-response latency problem, and the gap widens when analyst coverage is not continuous.

For identity teams, compromised credentials turn fileless malware from a stealth issue into an access-governance failure. The article’s credential-theft examples show that NHI and human identity controls both matter when attackers can simply log in and use legitimate administrative paths. That makes secret handling, privileged access governance, and offboarding discipline part of endpoint defence, not separate conversations.

Human coverage is now part of the control surface. The article’s 72% figure is important because it shows how often analysts outpaced traditional EDR alerting in Blackpoint’s observed cases. That does not mean technology failed entirely; it means triage, judgement, and containment timing are part of the defence model. Practitioners should treat 24/7 response as an operational control, not a service add-on.

Fileless malware exposes an endpoint blind spot that many MSPs still misread as tool coverage. Having antivirus and EDR deployed does not mean the environment is covered if attack tradecraft is evaluated only after office hours. The stronger governance model is to assume that legitimate admin tools can be turned into attack infrastructure and to monitor accordingly.

What this signals

Fileless malware turns trusted administration into an attack surface. If your environment still assumes that signed tools, approved scripts, and valid credentials are inherently benign, your control model is already behind the threat. Practitioners should expect the next wave of intrusions to exploit the same admin paths their teams rely on most.

Detection has to be judged at the sequence level, not the event level. A script launch, a network callback, and a credential access attempt may each look ordinary in isolation, but together they describe active tradecraft. Security teams need to tune for chains of behaviour that reveal intent before the attacker can pivot.

24/7 triage is now part of endpoint resilience. When telemetry arrives outside business hours, the difference between investigation and containment can decide whether a campaign is interrupted or allowed to spread. That makes off-hours response capacity a governance issue, not just an operational preference.

For practitioners

• Harden trusted scripting paths Restrict and monitor PowerShell, WMI, Command Prompt, and macro execution with command-line logging, script block logging, and policy controls that flag encoded or suspicious launches.
• Correlate process chains and context Build detections around parent-child process relationships, unusual process ancestry, network beacons after document execution, and access to credential stores rather than single events.
• Treat credential compromise as a fileless entry path Review remote access, RMM, and administrative accounts for MFA, least privilege, and abnormal login patterns because valid credentials can bypass malware delivery altogether.
• Add 24/7 human triage to endpoint telemetry Ensure suspicious in-memory execution, encoded commands, and off-hours alerts are investigated and contained by analysts who can distinguish admin activity from active tradecraft.
• Test for persistence that leaves no file Hunt for registry Run Keys, scheduled task abuse, and other memory-resident or script-based persistence methods that survive reboot without dropping conventional artefacts.

Key takeaways

• Fileless malware exploits the trust built into legitimate admin tooling, which makes file-centric antivirus coverage incomplete by design.
• The article’s strongest evidence is that behavioural detection and human triage outperformed traditional alerting in live campaigns.
• Teams reduce risk by governing PowerShell, WMI, credentials, and off-hours response as one control problem rather than separate ones.

Key terms

• Fileless Malware: Fileless Malware is malicious code that runs in memory or abuses legitimate system tools instead of writing a traditional executable file. It is harder to detect with file-based scanning and often relies on scripts, living-off-the-land techniques, or credential theft. Defenders watch for unusual parent-child processes, memory execution, and script abuse.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Behaviour-driven Detection: Behaviour-driven detection focuses on what an adversary does rather than only on where a signal comes from. It improves correlation and precision because the control is anchored to technique patterns that can appear across multiple tools and log sources.
• Endpoint Detection and Response: Endpoint detection and response is security software that monitors individual devices for suspicious activity, investigates threats, and supports containment actions. It is designed for persistent hosts such as laptops and servers, where an agent can collect telemetry over time and give responders visibility into process, file, and network behaviour.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and workload identity. It helps security and identity practitioners build stronger controls for the trust relationships attackers try to abuse.