sb-as logo
Story image

Exclusive: Fileless malware driving uptake of behavioural analytics

12 Nov 2018

Article by LogRhythm Asia Pacific and Japan senior regional marketing director Joanne Wong

Over the past year, a new form of malware has emerged that is able to more successfully evade traditional detection and defence techniques.

As a result, it is seeing increased use by attackers in the wild, and if the amount of research being devoted to it right now is any indication, security practitioners are sufficiently worried.

Most organisations and users are across vectors that malware typically uses to spread - dodgy file attachments, infected USB drives and the like.

This malware works by storing its payload on disk as an executable file or script that is then unleashed.

Antivirus software is designed to detect the creation of these types of files and check them against signatures of known malware.

If malware is detected, the file is deleted or quarantined before it can execute and cause damage. 

However, a newer strain of malware is “fileless” - that is, it is designed to operate exclusively in computer memory.

To execute, it abuses existing software, applications and authorised protocols on a machine so it can carry out its designated malicious activity.

Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).

For example, a user could visit a compromised page, which then uses Flash to instruct PowerShell to connect to a stealth command and control server where it downloads a malicious script.

Fileless malware was first seen in the wild in April 2015.

An early example targeting local users was JS_POWMET, which hit businesses in the Asia Pacific region.

When JS_POWMET was uncovered in August last year, the researchers involved noted that the rarity of finding a completely end-to-end fileless attack.

Not only did it infect a machine without a trace, but it also left no evidence after the malicious payload had executed, making it very difficult to spot again in the future.

Traditional families of malware are also changing to execute on a fileless basis.

Microsoft researchers noted back in mid-2016 that Kovter, a type of click-fraud malware, had been updated to become “almost fileless”.

The change didn’t completely allow it to avoid detection. 

However, the trend to evolve file-based malware into fileless malware is further evidence of the increasing sophistication of cyber attacks that is making it significantly harder to stop threats from entering corporate networks and devices. In addition to being triggered through web browsers, fileless malware is also known to exploit Microsoft Office applications and operating systems tools such as PowerShell (which is used to automate administration tasks on Windows), Visual Basic (VB) scripts and Windows Management Instrumentation (WMI).

McAfee uncovered a fileless malware campaign recently called Operation Gold Dragon that targeted the 2018 Winter Olympics, which was described as “an exemplary implementation of PowerShell malware in an attack”.

Fileless elements can also be found in other successful attacks.

Both the Petya and Wannacry ransomware outbreaks last year took advantage of “fileless techniques”, researchers have said.

Existing security strategies that incorporate file-based whitelisting, signature detection, hardware verification, pattern analysis or time stamping just won’t pick up fileless malware.

A potential weakness of fileless malware, however, is that as it works in-memory, it should only remain on the system until it is rebooted.

As a basic first step, regular system reboots are likely to deal with some fileless malware.

However, cybercriminals are now adding persistence to the malware code so that it resumes following a system restart.

Ultimately, the best approach is to use behavioural analytics, which monitor the activity of applications and services, including communications between processes, unauthorised requests to run applications, and changes to credentials or permission levels. For example, while many of the processes involved in fileless malware entering a network via a web browser are normal in isolation, the fact they happen concurrently is less normal, meaning they can be flagged and shut down before damage is done.

Story image
80% of cyber threat landscape uses COVID-19 as leverage - report
A report released recently by Proofpoint reveals the extent to which cyber attackers are capitalising on fear and paranoia surrounding the pandemic, with instances of coronavirus-themed attacks increasing every day.More
Story image
Zero trust security gaining momentum as a cybersecurity model
The model is centred on the belief that organisations should not automatically trust anything inside or outside its perimeters and instead must verify anything trying to connect to its systems before granting access, according to CSO.More
Story image
Internet infrastructure strained as demand for servers surges 30%
Internet service providers are extending data caps to meet the newfound reliance on the network, however, some experts express uncertainty concerning internet infrastructure’s ability to keep up with the rapidly growing demand.More
Story image
Kaspersky announces update to Microsoft Office 365 security solution as COVID-19 threats emerge
The upgrade introduces enhanced anti-phishing capabilities with a dedicated anti-spoofing feature, as well as bolstered protection within Microsoft Teams.More
Story image
Evasive malware reaches record levels - WatchGuard report
Evasive malware accounted for two thirds of all detections – a massive jump from the 2019 average of 35%.More
Story image
Forcepoint unveils impressive channel recruits across APAC and ANZ
Cybersecurity firm Forcepoint has named four new key appointments to its leadership team as it looks to strengthen its channel, strategy and sales lineup across the Asia Pacific and Australian New Zealand regions.More