Qay- The topic of fileless infection is both easy and complex to understand. I hope the following will serve:
1). first off, remember to set CF at the Proactive configuration to block things from any location.
2). When considering fileless malware, even though the mechanism of action of this type of malware varies- many hide out in RAM and from there inject into legit processes, something like POWELIKS will target the registry, Phasebot uses Powershell). The relatively recent Kovter malware family uses both methods.
3). But no matter what the mechanism is, the spawned stuff, no matter if it is Powershell or a hollowed svchost, would still be contained within the sandbox and suppressed from doing systemic damage. This sequestering of malicious activity would be seen both in the Comodo Sandbox or the also excellent Sandboxie.
4). Morphing malware- An absolute issue for the traditional AV and the main reason why I personally hold them in contempt. When initially coding a malware file it behooves one to add verbose code, one-shot loops, etc. These things can be removed one by one to have a zero day every day. Easy, Easy.
5). Time Delay method of Sandbox evasion- one of the standard methods used to trick a person to run a file outside the box. More popular is the dll search.
