Fileless and .NET Malware

What it is

Fileless malware runs mostly or entirely in memory and uses trusted tools already on the system, so it leaves little or nothing on disk for a classic antivirus scan to find. It is also called "living off the land" because the attacker uses built in tools such as PowerShell, WMI and scripting engines.

.NET malware is malicious software written for the Microsoft .NET framework. It is compiled to an intermediate language and is often loaded straight into memory, so the two topics overlap.

How it works

Fileless malware

The main characteristics are:

• No executable (or only a small loader) written to disk.
• Use of legitimate processes and tools, which makes the activity look normal.
• Persistence through places such as registry values, WMI event subscriptions and scheduled tasks.
• Activity that disappears at reboot unless persistence exists.

Because the disk shows little, memory forensics, command line logging and script logs become the key evidence.

The infection chain

1. Initial access: a phishing email, malicious website or exploited service.
2. Execution: a script or document macro starts a trusted interpreter, such as PowerShell.
3. Payload load: code is downloaded and run in memory, or injected into a legitimate process.
4. Persistence: a registry value, WMI subscription or scheduled task re-launches the script.
5. Action: credential theft, lateral movement, data theft or ransomware.

How fileless attacks work through different routes

In each case, the file on disk (if any) is a harmless looking starter.

Detecting Linux memfd_create() fileless malware with command line forensics

The Linux system call memfd_create() creates an anonymous file that exists only in memory. Attackers write a program into it and run it, so no file appears in the directory tree.

On a live Linux system the executable of such a process points to a memory file name. Useful checks:

ls -l /proc/*/exe 2>/dev/null | grep memfd

A match shows a process whose executable link points to /memfd:name (deleted).

ls -l /proc/<PID>/fd
cat /proc/<PID>/maps

The first lists the file descriptors held by the suspect process, and the second shows its memory mappings, where memfd entries appear. The process command line is in /proc/<PID>/cmdline and its parent in /proc/<PID>/status.

The investigator should record the findings, then capture the process memory or a full memory image before the process is stopped, because the in memory copy is the only copy of the program.

Infection chain of .NET malware

.NET programs are compiled to Common Intermediate Language (CIL) held in an assembly, which the Common Language Runtime (CLR) compiles to machine code at run time. A common chain:

1. Delivery by phishing email or a malicious link.
2. Loader stage: a document, script or small executable starts a first stage.
3. Download and decrypt: the next stage, often encrypted or obfuscated, is fetched or unpacked from a resource.
4. In memory load: the assembly is loaded into memory with .NET reflection, or injected into another process.
5. Final payload: a stealer, remote access tool or loader runs and contacts its C2 server.

Many families use layered obfuscation and packers, so the first sample is rarely the real payload.

Analyzing .NET malware

Because the assembly keeps rich metadata and CIL, it can often be decompiled back to near source code.

Analysis steps: hash the sample, identify what it is, examine strings, resources and imported functions, unpack any stages, review the decompiled code and extract IoCs such as C2 addresses and mutex names. All work is done in an isolated environment.

A worked example

An endpoint shows no suspicious files, but a PowerShell process with an encoded long command line is running and a scheduled task launches it every hour.

The investigator captures memory first, dumps the process, reads the command line and script block logs, and extracts the download address. The scheduled task is the persistence, and the address becomes an IoC.

How the exam asks about this

• "Which Linux system call creates anonymous in memory files used by fileless malware?" → memfd_create().
• "Where does fileless malware most often persist?" → Registry, WMI subscriptions or scheduled tasks.
• "Which tools decompile .NET assemblies?" → dnSpy, ILSpy and dotPeek.