Malware-free attacks expose the gap in endpoint detection

At a glance

What this is: This is an analysis of why malware-free attacks bypass traditional EDR assumptions and how privilege-aware controls change the detection model.

Why it matters: It matters because IAM, PAM, and endpoint teams need a shared view of privilege as a security signal, not just a permissions state, if they want to reduce blast radius across human and machine-driven activity.

By the numbers:

• 82% of detections in the last year were malware-free.
• 29 minutes.
• 39% of breaches across the full attack chain., across the full attack chain.

👉 Read Arcon's analysis of malware-free attacks and endpoint privilege risk

Context

The primary gap here is a security model that still assumes attacks arrive as malicious files. Malware-free intrusion breaks that assumption by using valid credentials and trusted binaries, which means the endpoint can appear healthy even while the account is being abused. For IAM and PAM teams, the issue is not just endpoint detection coverage, but whether privilege itself is being treated as a first-class security signal.

In identity terms, this is a human and privileged access problem more than a classic malware problem. When a logged-in user runs native tools with elevated rights, file-based detection has little to distinguish routine administration from abuse. That makes endpoint privilege management, access control, and behavioural telemetry part of the same governance conversation.

The article’s starting point is typical, not unusual: many programmes still rely on detection after credentials are already in play. That is exactly where malware-free attacks gain time.

Key questions

Q: How should security teams reduce risk from malware-free attacks on endpoints?

A: Start by removing standing local admin, then add privilege-aware telemetry so elevation requests, denials, and unusual admin actions are visible in your monitoring stack. Malware-free attacks succeed when valid credentials and trusted binaries remain inside the normal trust boundary. Reducing that boundary is more effective than relying on file detection alone.

Q: Why do valid credentials create harder-to-detect breaches?

A: Valid credentials bypass many traditional security signals because the access looks legitimate at the protocol level. The abuse shows up in identity context, not in obvious malware or exploit indicators. That is why teams need behavioural baselines for machine identities, not just perimeter alerts or signature-based detections.

Q: What fails when EDR is the only control stopping lateral movement?

A: EDR can detect malicious behaviour, but by itself it does not stop an attacker from using trusted internal paths to move elsewhere. When the environment is flat or weakly segmented, the compromise can spread before response actions finish. The failure is treating visibility as containment. Effective defence needs a control that limits where the attacker can go next, not just a faster alert.

Q: How do organisations decide between detection and prevention for endpoint privilege risk?

A: Use both, but prioritise prevention where elevated access is persistent. If accounts do not have standing admin rights and privileged execution is time-bound, the attacker’s options shrink sharply. Detection still matters, but it should confirm abuse, not carry the whole defence model.

Technical breakdown

Why malware-free attacks evade file-based endpoint detection

Traditional EDR was built around the assumption that adversaries introduce something malicious to the endpoint. Malware-free attacks remove that assumption by using valid credentials, built-in admin utilities, and native system binaries such as PowerShell or WMI. Because those tools already exist on the machine, they often blend into ordinary administration. The technical failure is not that EDR sees nothing at all, but that the observable activity sits inside the trust boundary of legitimate system behaviour. That is why living off the land remains effective: it turns the defender’s reliance on file reputation and signature logic into a blind spot.

Practical implication: Practitioners need controls that distinguish authorised administration from privileged misuse, not just tools that inspect files and binaries.

Privilege elevation telemetry as a detection signal

The article points to elevation requests, denials, and anomalous admin actions as the signal layer EDR often ignores. That telemetry is important because privilege behaviour has a shape: normal users elevate in patterns, on systems, and at times that reflect their role. A compromised account often breaks that pattern before it trips a file alert. This makes privilege data useful for behavioural analytics, especially when read alongside endpoint events and PAM session records. The technical value is that privilege use is harder to fake than process names or parent-child chains, particularly when the attacker depends on legitimate access.

Practical implication: Correlate elevation events with PAM and endpoint telemetry so abnormal privilege behaviour becomes visible before lateral movement completes.

Why standing local admin expands the attack surface

Standing local administrator rights give attackers a ready-made path from initial access to execution and later movement. If the account already has elevated rights, the attacker does not need to introduce malware or wait for a separate approval step. That shrinks the distance between login and impact. Just-in-time elevation changes the mechanics by making privilege time-bound and task-scoped, which reduces the window in which a valid account can be abused. The control issue is not simply least privilege in theory, but whether elevated rights exist persistently enough to be stolen or repurposed.

Practical implication: Remove standing local admin where possible and make privileged execution temporary, approved, and auditable.

Threat narrative

Attacker objective: The attacker wants to operate inside the trust boundary long enough to move laterally, expand privileges, and achieve impact without triggering file-based detections.

1. Entry occurs when an attacker uses valid credentials to log in and appears as a legitimate user rather than introducing a malicious file.
2. Escalation follows when the attacker abuses native tools and elevated rights to run trusted binaries, request admin access, or move through the environment.
3. Impact occurs when the attacker completes lateral movement and reaches objectives before traditional detection can separate abuse from normal administration.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Malware-free intrusion exposes a privilege visibility gap, not just an endpoint detection gap. EDR can still be useful, but it was never designed to explain why a trusted account suddenly behaves like an attacker. That distinction matters because valid credentials and native binaries sit inside the normal operating envelope of many endpoint tools. The practitioner conclusion is that endpoint defence must be interpreted through privilege behaviour, not file presence alone.

Standing local admin is the easiest way to turn a normal login into an attack path. When elevated access persists, the attacker does not need to stage malware, request repeated approvals, or wait for a separate privilege grant. The control failure is persistence of privilege, which gives an intruder room to execute trusted tools as if they were authorised. The implication is that blast radius is created before detection ever begins.

Privilege telemetry is the missing identity signal in malware-free environments. Elevation requests, denials, and unusual admin actions show whether a user is operating within expected authority. That signal is more durable than process reputation when the adversary uses legitimate tools. The conclusion for IAM and PAM teams is that endpoint telemetry and identity governance now share a common evidence layer.

JIT privilege only helps when it is enforced at the point of execution, not merely documented in policy. Time-bound elevation shrinks the window in which a compromised credential can be repurposed. If the access model still allows persistent admin rights or broad application elevation, the security programme is preserving the very conditions malware-free attackers rely on. Practitioners should treat ephemeral privilege as a control boundary, not an administrative convenience.

From our research:

• 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to the 2024 Non-Human Identity Security Report.
• Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
• That gap makes Ultimate Guide to NHIs , Static vs Dynamic Secrets a useful next step for teams reassessing access control assumptions.

What this signals

Privilege-aware endpoint monitoring is becoming an identity problem as much as an endpoint problem. When valid credentials and trusted tools can bypass file-based controls, the practical boundary shifts from malware detection to access behaviour. Teams that still separate endpoint operations from IAM and PAM governance will miss the signal that matters most: who can elevate, when, and under what conditions.

Standing privilege is the real multiplier in malware-free intrusion. The issue is not only whether a device is monitored, but whether an account can repeatedly turn routine activity into privileged execution. For programmes maturing their control stack, the priority is to compress the privilege window and make elevation auditable enough to feed detection, response, and access review.

For identity teams, the takeaway is that endpoint data now has governance value. 52 NHI Breaches Analysis shows how access persistence and weak lifecycle control repeatedly extend attacker dwell time, and that lesson increasingly applies wherever identities can act with authority. The programme signal is clear: if privilege can persist, abuse can persist with it.

For practitioners

• Remove standing local administrator access Audit endpoints for persistent admin rights and eliminate them where business use does not require them. The goal is to reduce the number of accounts that can turn a valid login into immediate privileged execution.
• Instrument privilege elevation as a security signal Send elevation requests, denials, and abnormal admin actions into your SIEM and behavioural analytics stack so suspicious privilege patterns are visible alongside endpoint alerts.
• Restrict which applications can elevate Use application allow listing and controlled elevation so trusted binaries do not automatically inherit privilege. That reduces the value of native tools to an attacker who already has a foothold.
• Align PAM and endpoint telemetry Correlate PAM sessions with endpoint activity to confirm whether elevated actions match approved work. This helps separate legitimate administration from abuse that would otherwise look normal.

Key takeaways

• Malware-free attacks succeed because they operate inside the trust model that many endpoint tools were built to assume.
• The strongest evidence in this article is the privilege signal: elevation behaviour, not file reputation, reveals abuse earlier.
• Removing standing admin and enforcing time-bound elevation changes the attack economics before detection is even required.

Key terms

• Malware-free attack: An intrusion that does not rely on a malicious file or obvious payload to succeed. The attacker uses valid credentials and trusted system tools, which makes the activity look legitimate unless privilege and identity behaviour are monitored closely.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Endpoint Privilege Management: Endpoint privilege management is the control of what software can do on a workstation, including installation, elevation, and runtime behavior. In shadow AI environments, it becomes a way to discover and constrain local model runtimes, plug-ins, and binaries that might otherwise bypass standard software oversight.
• Privilege telemetry: Privilege telemetry is the set of logs and events that show when access is granted, changed, or used in a high-risk way. It includes authentication activity, role changes, token use, and other signals that can reveal abuse before it spreads.

What's in the full article

Arcon's full article covers the operational detail this post intentionally leaves for the source:

• How the vendor frames privilege analytics inside endpoint privilege management and where it fits in a wider control stack.
• The specific behaviour patterns the vendor says are most useful for spotting malware-free abuse on endpoints.
• The practical distinction between removing standing admin and controlling application elevation in day-to-day operations.
• How the vendor positions JIT privilege and behavioural telemetry together for endpoint governance.

👉 Arcon's full post covers the privilege telemetry model, elevation controls, and the detection gap in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.