Yes. Fileless malware stores payloads as encoded data in the Windows registry and executes them entirely in memory using PowerShell or WScript. Nothing is written to disk in a form traditional antivirus scans. The registry entry looks like an application setting. Execution leaves minimal forensic artifacts compared to file-based malware.
Analysis Briefing
- Topic: Fileless malware persistence via Windows registry and PowerShell
- Analyst: Mike D (@MrComputerScience)
- Context: Originated from a live session with DeepSeek V3
- Source: Pithy Security
- Key Question: If malware never writes a file, why does your antivirus have nothing to scan?
How Registry-Resident PowerShell Payloads Execute in Memory
The attack chain starts with initial access: a malicious macro, a phishing link, or an exploit that runs a short dropper. The dropper base64-encodes a PowerShell payload and writes it to a registry key, typically under HKCU\Software or run keys that execute on login. It then creates a scheduled task or registry run entry that calls PowerShell with -EncodedCommand to decode and execute the stored payload.
At execution time, PowerShell reads the registry value, decodes it, and runs it entirely in memory using Invoke-Expression or [System.Reflection.Assembly]::Load(). No executable file touches the disk. The payload can be a full reverse shell, a keylogger, or a staged loader that downloads additional components.
Traditional AV products scan files at write time and on access. A payload that is never written as a file never gets scanned.
Why Traditional AV Misses Fileless Execution Techniques
Antivirus signatures target file hashes and byte patterns in files on disk. A base64 string in the registry looks like application data. An encoded PowerShell command looks like a configuration value. Neither matches file-based signatures.
Behavior-based detection from EDR products catches fileless malware more reliably. PowerShell executing encoded commands that then make network connections is a behavioral pattern that CrowdStrike Falcon, Microsoft Defender for Endpoint, and SentinelOne flag regardless of whether the payload touched disk.
AMSI (Antimalware Scan Interface) is Microsoft’s partial solution. PowerShell 5.0 and later pass script content through AMSI before execution, giving AV engines a chance to scan the decoded payload in memory. Attackers bypass AMSI by patching it in memory before executing the payload, which is itself a detectable behavior.
When Memory Forensics with Volatility Recovers Fileless Artifacts
Memory analysis is the primary forensic technique for fileless malware investigation. A memory image captured from an infected system contains the decoded payload, the PowerShell process with its loaded modules, and the network connections the payload established.
Volatility 3’s windows.cmdline and windows.malfind plugins identify suspicious process command lines and memory regions with execute permissions that do not correspond to loaded modules on disk. These are the primary indicators of reflective loading and fileless execution.
Registry forensic analysis using tools like RECmd or registry hive parsing in Velociraptor identifies the stored encoded payload and the run key that established persistence. The registry artifacts survive system reboots and provide the persistence mechanism evidence that memory analysis alone cannot.
What This Means For You
- Deploy an EDR product with behavioral detection, because fileless malware specifically evades signature-based AV and only behavioral monitoring of PowerShell execution and network activity catches it reliably.
- Enable PowerShell Script Block Logging via Group Policy, because script block logs record decoded PowerShell content before execution and are the most valuable detection artifact for encoded command attacks.
- Monitor registry run keys for base64-encoded or obfuscated values using Autoruns from Sysinternals, because legitimate applications do not store base64-encoded executable content in startup registry keys.
- Restrict PowerShell execution policy and disable
-EncodedCommandfor users who do not need it, because the encoded command flag is the primary delivery mechanism for registry-resident payloads.
Enjoyed this deep dive? Join my inner circle:
- Pithy Security → Stay ahead of cybersecurity threats.