# What is Fileless Malware?

> Fileless malware is malicious code or activity that executes mainly from memory or through existing system facilities instead of relying on a conventional executable stored on disk.

- Canonical URL: https://yellowcube.eu/glossary/fileless-malware/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The label does not mean that no files ever exist: scripts, shortcuts, logs, registry data, downloaded components, or other artifacts may still be created before, during, or after execution.

An intrusion may use command interpreters, management interfaces, document features, in-memory loading, or nontraditional storage to run code and maintain access. Some of those facilities are legitimate and widely used, so investigation must distinguish normal administration from an unexpected chain of processes, identities, persistence changes, and network activity.

### Key points

- **Execution evidence:** Examine process ancestry, command and script content, memory, loaded modules, account activity, and changes to system configuration rather than searching only for a dropped executable.
- **Persistence and storage:** Check scheduled actions, services, registry or management repositories, user profiles, cloud control planes, and other locations that can retain instructions or encoded content.
- **Defensive approach:** Restrict unnecessary interpreters and administrative interfaces, log their use, apply least privilege, protect credentials, and correlate endpoint, identity, and network telemetry.
- **Important limitation:** “Fileless” is an imprecise umbrella term, not proof of sophistication or invisibility. Legitimate tools can look similar, in-memory evidence is volatile, and file-focused detection may find scripts, logs, or supporting components.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Living off the land (LOTL)](<https://yellowcube.eu/glossary/living-off-the-land/>) · [Malware analysis](<https://yellowcube.eu/glossary/malware-analysis/>) · [Endpoint detection and response (EDR)](<https://yellowcube.eu/glossary/endpoint-detection-and-response/>) · [Command and control (C2)](<https://yellowcube.eu/glossary/command-and-control/>)

### Sources

[MITRE ATT&CK T1027.011: Fileless Storage](https://attack.mitre.org/techniques/T1027/011/) · [MITRE ATT&CK T1620: Reflective Code Loading](https://attack.mitre.org/techniques/T1620/) · [CISA Continuous Diagnostics and Mitigation Data Model v5.0.1](https://www.cisa.gov/sites/default/files/2024-12/CDM%20Data%20Model%20Document%20V5.0.1%20Public%20Release508.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.