Being Infected with Fileless Malware

[Davidov]

Nice article about Fileless Malware


Being Infected with Fileless Malware | The Security Blogger

 

[Winter Soldier]

Indeed, to inject a code in a running process requires that before being carried out some actions. Once the code is in memory, it can perform any action allowed to the same user. If the user has an administrator access of the system, the latter can be completely compromised, but if the account has a limited access will require additional steps to attack the system completely.
So another good reason for not using Admin account.

 

[shmu26]

best protection against fileless exploits is to use safe software and keep it updated. Also keep the OS updated.
and if the software has safety settings, keep them enabled.

If you want to get exploited, run Internet Explorer on Windows XP, and use an old version of MS Office with macros enabled.

 

[Winter Soldier]

best protection against fileless exploits is to use safe software and keep it updated. Also keep the OS updated.
and if the software has safety settings, keep them enabled.

If you want to get exploited, run Internet Explorer on Windows XP, and use an old version of MS Office with macros enabled.

A malicious javascript can call a PowerShell encrypted script, and considering that it isn't saved any file, it uses PowerShell to hide the process so the malware is thus more difficult to identify.
You are correct, the first step against fileless malware is to ensure that the system and the browser are secure with updated patches.
Behavior blocker and operating system call control, may also detect unauthorized external connections or access not provided to the Windows registry. In addition, to prevent the execution of harmful PowerShell, the most important thing to verify is scripts have digital signature.