Malware-free attacks expose the gap in endpoint detection

At a glance

What this is: This analysis says malware-free attacks bypass file-centric endpoint tools by blending in as normal logins, trusted binaries, and legitimate admin activity.

Why it matters: It matters because IAM, PAM, and endpoint teams need to treat privilege behaviour as a detection surface, not just a prevention boundary, when attacks use valid credentials and native tools.

By the numbers:

• 82% of detections in the last year were malware-free, according to CrowdStrike Global Threat Report 2026 cited by Arcon.
• Median eCrime breakout time is now 29 minutes, according to CrowdStrike Global Threat Report 2026 cited by Arcon.

👉 Read Arcon's analysis of malware-free attacks and the endpoint detection gap

Context

Malware-free attacks are intrusions that avoid dropping a malicious file and instead rely on valid credentials, native system tools, and ordinary-looking execution paths. That pattern breaks endpoint programs that were built to spot malware signatures, suspicious binaries, or sandbox-triggered artefacts.

For identity and access teams, the problem is not only detection coverage. When a threat actor uses a real account and trusted tooling, the endpoint often sees legitimate activity, while the real signal sits in elevation requests, denied privileges, and unusual administrative behaviour.

Arcon's article treats that shift as a warning for programmes that still depend on file-centric endpoint controls as the primary line of defence. That is now an incomplete model for credential-driven intrusion and privilege abuse.

Key questions

Q: What breaks when endpoint security can detect threats faster than it can remediate them?

A: Detection without remediation speed creates a control gap where attackers can persist, move laterally, or trigger wider business disruption before the threat is removed. In practice, the organization gains more alerts but not more safety. Teams should measure how quickly they can isolate, scope, and recover endpoints, because that is the real containment outcome.

Q: Why do valid credentials and trusted tools increase intrusion risk?

A: Because they let an attacker operate inside normal-looking workflows. When a real account runs built-in utilities, endpoint tools often see approved activity rather than malicious code. That lowers alert quality and raises the chance that privilege abuse proceeds before defenders can separate hostile action from ordinary administration.

Q: How do security teams know whether least privilege is actually working?

A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements. A good signal is whether a compromised identity would be unable to move beyond one bounded workflow. If broad resource reach still exists, the control is not effective.

Q: Should teams prioritise privilege reduction or better endpoint detection?

A: Privilege reduction should come first when attacks are credential-driven and malware-free, because detection alone cannot reliably distinguish legitimate from hostile execution. Removing standing admin rights and controlling app elevation reduces the attacker’s room to manoeuvre, while endpoint detection then has a smaller, better-defined problem to solve.

Technical breakdown

Why valid credentials make endpoint detection unreliable

Endpoint detection works best when the adversary introduces something distinguishable from normal operations. Malware-free attacks remove that distinction by using real credentials and built-in tools such as PowerShell, WMI, and native admin utilities. At that point, the endpoint is not watching an obvious payload. It is watching an authenticated session using approved binaries, which makes file-layer detection weak by design. The security problem is not that EDR is broken. It is that its visibility boundary stops at the wrong layer when the attacker inherits legitimate access paths.

Practical implication: shift some detection logic from file reputation to identity and privilege behaviour.

Why privilege activity is the missing signal

Privilege behaviour is a richer control plane than file execution because it records what the account is trying to do, not just what software is present. Elevation requests, denied admin actions, unusual use of local administrator rights, and abnormal application elevation patterns are all data points that can expose a compromise before malware appears. This is where endpoint privilege management becomes a security sensor as much as a control. If an account suddenly behaves unlike its historical privilege profile, the attack may already be in motion even though the device looks clean.

Practical implication: collect and review elevation telemetry alongside endpoint alerts.

How living off the land defeats file-centric controls

Living off the land means using tools already present on the endpoint to move, persist, or escalate without adding obvious malware. Because those tools are native and trusted, signature-based controls and many behaviour models see routine administrative activity instead of intrusion. The risk compounds when standing local admin rights remain available, because attackers do not need to steal a special exploit if the account already holds enough power to run privileged commands. The control gap is therefore architectural, not merely operational: the machine still trusts too much at execution time.

Practical implication: remove standing local admin and restrict which binaries can run with privilege.

Threat narrative

Attacker objective: The attacker wants to progress from authenticated access to privileged execution and lateral movement without triggering malware-based detection.

1. Entry occurs through valid credentials and a legitimate login rather than a malicious file drop, so the session begins as trusted activity.
2. Credentialed access is then used to run native tools and issue elevation requests that resemble ordinary administrator work.
3. The attacker escalates by abusing local privilege or trusted binaries, then moves laterally before defenders can distinguish the session from normal use.
4. Impact follows quickly because the intrusion completes inside the short breakout window and bypasses file-based detection altogether.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privilege telemetry is now a first-class security signal, not a tuning aid: When malware is absent, the most meaningful evidence of compromise is often elevation behaviour. File reputation cannot tell you whether a signed binary is being used by the right person, but privilege telemetry can show account behaviour that diverges from the norm. That makes elevation requests, denials, and abnormal admin actions central to modern endpoint governance.

Standing privilege creates the exact condition malware-free intrusions need: If local admin rights persist by default, an attacker who logs in with valid credentials already has most of the access required to weaponise native tools. This is not a sophisticated bypass. It is a governance failure where the control model assumes privileged use is rare enough to notice after the fact. The implication is that endpoint privilege must be treated as a precondition, not a post-incident signal.

Endpoint detection without privilege governance is an incomplete assurance model: EDR still has value, but it cannot close a gap created by trusted tools, real credentials, and short breakout time. The stronger model is to pair endpoint observation with privilege reduction so that the attacker has fewer ways to become powerful inside the session. Practitioners should view this as a shift from file-centric assurance to execution-authority assurance.

Identity blast radius is the right concept for this attack class: The article points to a control gap where every authenticated account can become a launch point for privileged execution. Once that happens, the blast radius is defined less by malware and more by what the account can elevate, run, and reach. Teams should measure how much damage an ordinary login can cause before endpoint controls notice.

JIT privilege changes the economics of endpoint compromise: Time-bound elevation reduces the window in which trusted binaries can be abused with standing rights. That does not eliminate attack risk, but it narrows the attacker’s usable privilege state and makes anomalous elevation more visible. For practitioners, the governance question is whether privilege exists by default or only long enough to complete a specific task.

What this signals

Privilege-centric detection is the missing control layer: Endpoint programmes that still anchor on malware signatures are watching the wrong signal for credential-driven attacks. The practical shift is to treat elevation requests, denials, and privileged command patterns as first-order telemetry, because those events reveal misuse even when the binary itself is trusted.

Identity blast radius is now an endpoint design issue: When authenticated users can still elevate freely, the compromise path is short and the defender’s response window is shorter. Endpoint controls must therefore be designed around what an account can do after login, not just whether the login succeeded.

Just-in-time privilege changes the attacker’s usable state: Short-lived elevation reduces the amount of time a trusted session can be abused with high privilege. That is especially relevant where native tools and valid credentials make hostile activity blend into ordinary administration.

For practitioners

• Remove standing local administrator rights Reassess endpoint accounts that retain local admin by default and move routine users to standard privileges unless a task explicitly requires elevation.
• Instrument elevation telemetry Feed elevation requests, denied actions, and admin command use into detection logic so privilege behaviour becomes visible alongside endpoint alerts.
• Control application elevation Allow only approved applications to execute with privilege and block trusted-binary abuse where elevation is not part of the task scope.
• Shorten privileged access windows Use just-in-time privilege for administrative tasks so elevated rights exist only for the task duration and are revoked when the task ends.
• Correlate endpoint and PAM signals Join endpoint activity with privileged access logs so a real login followed by unusual elevation or admin behaviour is easier to triage.

Key takeaways

• Malware-free attacks expose a structural weakness in endpoint defence because the intrusion can appear as ordinary authenticated work.
• The article's evidence shows that 82% of detections were malware-free and the median breakout time was 29 minutes, leaving little room for reactive triage.
• Reducing standing privilege and watching elevation behaviour are the controls most likely to limit this attack pattern before it spreads.

Key terms

• Malware-free attack: An intrusion that does not rely on a malicious file or obvious payload to succeed. The attacker uses valid credentials and trusted system tools, which makes the activity look legitimate unless privilege and identity behaviour are monitored closely.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Privilege telemetry: Privilege telemetry is the set of logs and events that show when access is granted, changed, or used in a high-risk way. It includes authentication activity, role changes, token use, and other signals that can reveal abuse before it spreads.
• Endpoint Privilege Management: Endpoint privilege management is the control of what software can do on a workstation, including installation, elevation, and runtime behavior. In shadow AI environments, it becomes a way to discover and constrain local model runtimes, plug-ins, and binaries that might otherwise bypass standard software oversight.

What's in the full article

Arcon's full article covers the operational detail this post intentionally leaves for the source:

• How endpoint privilege management turns elevation events into behavioural telemetry
• Why living off the land defeats file-focused detection and how privilege controls narrow the gap
• How just-in-time privilege and application allow listing reduce the attack surface on endpoints
• What the article says about pairing EDR with privilege analytics and PAM data

👉 The full Arcon article covers privilege telemetry, living-off-the-land abuse, and the controls that shrink attacker reach.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.