An emerging threat Fileless malware: a survey and research challenges

Abstract

With the evolution of cybersecurity countermeasures, the threat landscape has also evolved, especially in malware from traditional file-based malware to sophisticated and multifarious fileless malware. Fileless malware does not use traditional executables to carry-out its activities. So, it does not use the file system, thereby evading signature-based detection system. The fileless malware attack is catastrophic for any enterprise because of its persistence, and power to evade any anti-virus solutions. The malware leverages the power of operating systems, trusted tools to accomplish its malicious intent. To analyze such malware, security professionals use forensic tools to trace the attacker, whereas the attacker might use anti-forensics tools to erase their traces. This survey makes a comprehensive analysis of fileless malware and their detection techniques that are available in the literature. We present a process model to handle fileless malware attacks in the incident response process. In the end, the specific research gaps present in the proposed process model are identified, and associated challenges are highlighted.

Tight Arms Race: Overview of Current Malware Threats and Trends in Their Detection

“…Another possible mechanism to evade detection is the use of a fileless architecture, which is becoming a relevant trend. For instance, the recent survey [22] provided an overview of the fileless malware and related detection techniques. Owing to its nature, this class of threat remains unnoticed by the traditional file-focused detection systems; thus, the authors concluded that the detection of fileless malware may require the use of forensic tools.…”

“…• limited interest in information hiding: as shown, only one recent work dealt with information hiding (specifically, in the context of mobile devices). As modern mal- [23] x x x x x [16] x x x x x [24] x x [22] x x fileless [31] x adversarial ML [17] x tools [25] x AI [14] x x x evasion, tools [34] x x x evasion [18] x x evasion [21] x x APT [28] x x cybersecurity [19] x evasion [26] x x x x [27] x x cybersecurity [36] x x x visualisation [30] x x [11] x x behavior analysis, visualisation [12] x analysis [37] x x [33] x x x evasion [29] x x x [15] x x x x x [20] x x stealth malware [32] x x x C&C communication [35] x x x OS openness [38] x x [39] x visualisation ware is increasingly exploiting some form of steganography, information hiding and obfuscation to launch attacks or exfiltrate data [42], [43], this consolidated trend should be taken into account. • lack of sufficient coverage of new threats: despite the vivacity of the topic, many works continue to focus on the "legacy" hazards, e.g., phishing.…”

“…When compared to the traditional file-based malware, the fileless malicious software does not download any files or write any content to the disk of the infected machine [22]. Typically, the attacker is using vulnerabilities existing in the common applications to inject malicious code directly into the main memory.…”

“…Currently, three classes of fileless malware can be roughly distinguished [22]: memory-resident, Windowsregistry-based, and rootkit malware. Memory-resident malware (e.g., Lurk trojan or Poweliks) injects itself into the main memory of the infected device without modifying the file systems.…”

Detection of Anomalous In-Memory Process based on DLL Sequence

“…Hence the detection complexity becomes too high for Fileless malware. The possibility of investigating Fileless malware is only limited to analysis of the behavior of the system using the snapshots of In-memory processes, which is considered here as Memory based analysis [16]. Information retrieval theory is applied with a dynamic analysis to extract API calls and system calls to classify malicious programs.…”