This paper presents an analysis of fileless malware and its evasive behaviour, focusing on how modern cyber threats operate without leaving traces on disk. It explores key attack techniques such as memory-based execution and the use of legitimate system tools. The study also highlights the limitations of traditional security systems and discusses advanced detection methods including behavior-based monitoring and memory forensics. The paper further examines the lifecycle of fileless attacks, from initial entry points such as phishing and malicious scripts to in-memory execution and persistence mechanisms. It provides insights into how attackers exploit trusted utilities like PowerShell and Windows Management Instrumentation (WMI) to execute malicious activities while appearing legitimate. This stealthy nature allows attackers to bypass conventional antivirus and intrusion detection systems. In addition, the study evaluates modern detection approaches such as endpoint detection and response (EDR), process monitoring, and network traffic analysis. These techniques help in identifying abnormal system behavior and detecting hidden threats that do not rely on file-based signatures. The challenges associated with detecting such threats, including false positives and high computational requirements, are also discussed. The findings emphasize the importance of adopting advanced cybersecurity frameworks that focus on real-time monitoring, behavioral analysis, and memory inspection. This work contributes to a deeper understanding of evolving cyber threats and highlights the need for continuous research and innovation in cybersecurity. It also provides a foundation for developing more robust and intelligent detection systems capable of mitigating sophisticated fileless malware attacks in modern computing environments.
Gopan et al. (Sat,) studied this question.