What it does. 'Detects fileless malware and in-memory attacks that execute entirely Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-fileless-attacks-on-endpoints, or copy the skill folder into ~/.claude/skills/detecting-fileless-attacks-on-endpoints/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-fileless-attacks-on-endpoints/SKILL.md

SKILL.md (verbatim)

name: detecting-fileless-attacks-on-endpoints
description: 'Detects fileless malware and in-memory attacks that execute entirely
  in RAM without writing persistent files to disk, evading traditional antivirus.
  Use when building detections for PowerShell-based attacks, reflective DLL injection,
  WMI persistence, and registry-resident malware. Activates for requests involving
  fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land
  techniques.

  '
domain: cybersecurity
subdomain: endpoint-security
tags:
- endpoint
- fileless-malware
- memory-attacks
- PowerShell
- detection-engineering
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
mitre_attack:
- T1055
- T1547
- T1059
- T1036
- T1053

Detecting Fileless Attacks on Endpoints

When to Use

Use this skill when:

• Building detection rules for fileless malware that operates entirely in memory
• Hunting for PowerShell-based attacks, reflective DLL injection, and WMI abuse
• Configuring endpoint telemetry (Sysmon, AMSI, PowerShell logging) to capture fileless indicators
• Investigating incidents where traditional AV found no malicious files

Do not use for detecting file-based malware or for malware reverse engineering.

Prerequisites

• Sysmon with process creation and WMI event logging enabled
• PowerShell Script Block Logging and Module Logging enabled
• AMSI (Antimalware Scan Interface) enabled for script content inspection
• EDR with behavioral detection capabilities (MDE, CrowdStrike, SentinelOne)

Workflow

Step 1: Enable Required Telemetry

# Enable PowerShell Script Block Logging (GPO or registry)
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" `
  -Name EnableScriptBlockLogging -Value 1 -PropertyType DWORD -Force

# Enable PowerShell Module Logging
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" `
  -Name EnableModuleLogging -Value 1 -PropertyType DWORD -Force

# Enable PowerShell Transcription
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription" `
  -Name EnableTranscripting -Value 1 -PropertyType DWORD -Force

# Sysmon config for fileless detection (key events):
# Event ID 1: Process creation (captures CommandLine)
# Event ID 7: Image loaded (DLL loading)
# Event ID 8: CreateRemoteThread (injection)
# Event ID 10: Process access (LSASS access)
# Event ID 19/20/21: WMI events

Step 2: Detect PowerShell-Based Attacks

# Indicators of malicious PowerShell:

# Encoded command execution
EventID: 1
CommandLine contains: "powershell" AND ("-enc" OR "-e " OR "-encodedcommand" OR "FromBase64String")

# Download cradle patterns
CommandLine contains: "IEX" AND ("Net.WebClient" OR "DownloadString" OR "Invoke-WebRequest")
CommandLine contains: "Invoke-Expression" AND "New-Object"

# AMSI bypass attempts (Event ID 4104 - Script Block)
ScriptBlock contains: ("Amsi"+"Utils") OR ("amsi"+"InitFailed") OR "SetValue.*amsi"

# Splunk query for suspicious PowerShell:
index=windows source="WinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| where match(ScriptBlockText, "(?i)(iex|invoke-expression|downloadstring|net\.webclient|frombase64|bypass|amsi.utils)")
| table _time host ScriptBlockText

Step 3: Detect Process Injection Techniques

# Reflective DLL injection - loads DLL from memory without touching disk
# Detection: Sysmon Event 7 (ImageLoaded) where image path is unusual
EventID: 7
ImageLoaded NOT starts with: "C:\Windows\" AND NOT starts with: "C:\Program Files"

# Process hollowing - creates process in suspended state, replaces memory
# Detection: Process creation followed by immediate memory write
EventID: 1 + 10 correlation
# Process created then accessed with PROCESS_VM_WRITE

# APC injection - queues code to thread's async procedure call queue
# Detection: Sysmon CreateRemoteThread from non-system process
EventID: 8
SourceImage NOT IN (known_legitimate_sources)

# MDE KQL:
DeviceEvents
| where ActionType in ("CreateRemoteThreadApiCall", "NtAllocateVirtualMemoryApiCall")
| where InitiatingProcessFileName !in ("MsMpEng.exe", "svchost.exe")
| project Timestamp, DeviceName, ActionType, InitiatingProcessFileName,
    InitiatingProcessCommandLine, FileName

Step 4: Detect WMI-Based Persistence

# Sysmon Event IDs 19/20/21 for WMI events
EventID: 19  # WmiEventFilter activity detected
EventID: 20  # WmiEventConsumer activity detected
EventID: 21  # WmiEventConsumerToFilter activity detected

# Any WMI event subscription creation is suspicious unless expected
# Common malicious WMI persistence:
Consumer contains: "CommandLineEventConsumer" OR "ActiveScriptEventConsumer"

# Query for WMI subscriptions via osquery or PowerShell:
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

Step 5: Detect Registry-Based Execution

# Malware stored in registry values and executed via PowerShell
# Sysmon Event 13 - Registry value set with encoded content
EventID: 13
TargetObject contains: "CurrentVersion\Run"
Details: unusually long value or Base64-encoded content

# Detection query:
index=sysmon EventCode=13
| where match(Details, "[A-Za-z0-9+/=]{100,}")
| table _time host TargetObject Details Image

Key Concepts

Tools & Systems

• Sysmon: Kernel-level process, DLL, and WMI monitoring
• AMSI: Windows script content inspection API
• PowerShell Logging: Script Block, Module, and Transcription logging
• Microsoft Defender for Endpoint: Behavioral detection for fileless techniques
• Volatility 3: Memory forensics for post-incident fileless malware analysis

Common Pitfalls

• Relying on file-based AV: Traditional AV that scans files on disk will miss fileless attacks entirely. Behavioral detection and AMSI are required.
• Disabled PowerShell logging: Without Script Block Logging, deobfuscated PowerShell commands are invisible to defenders.
• AMSI bypass not detected: Sophisticated attackers bypass AMSI before executing payloads. Detect AMSI bypass attempts as a high-priority alert.
• Not monitoring WMI events: WMI persistence is a favored technique of APT groups. Sysmon events 19-21 must be enabled.

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Fileless Attack Detection Template

Telemetry Status

Detection Rules

Sign-Off

references/api-reference.md (verbatim)

API Reference: Detecting Fileless Attacks on Endpoints

Key Event Sources

python-evtx Usage

import Evtx.Evtx as evtx
with evtx.Evtx("PowerShell-Operational.evtx") as log:
    for record in log.records():
        xml = record.xml()
        # Parse Event 4104 ScriptBlockText

Suspicious PowerShell Patterns

# Dynamic execution
r"Invoke-Expression|IEX\s*\("
# Reflective loading
r"System\.Reflection\.Assembly.*Load"
# Memory injection APIs
r"VirtualAlloc|VirtualProtect|CreateThread"
# WMI persistence
r"Register-WMI|__EventFilter|__EventConsumer"
# Encoded commands
r"-enc\s|-encodedcommand\s"

Splunk SPL - Fileless Detection

index=powershell EventCode=4104
| where match(ScriptBlockText, "(?i)(Invoke-Expression|IEX|VirtualAlloc|FromBase64)")
| stats count by ScriptBlockText, Computer, UserID

AMSI (Anti-Malware Scan Interface)

# Enable AMSI logging
Set-MpPreference -EnableNetworkProtection Enabled
# Check AMSI status
Get-MpComputerStatus | Select AMServiceEnabled, AntispywareEnabled

WMI Persistence Detection

# List WMI event subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class __EventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

CLI Usage

python agent.py --ps-log PowerShell-Operational.evtx
python agent.py --sysmon-log Sysmon.evtx --check-wmi --check-injection

references/standards.md (verbatim)

Standards & References

• MITRE ATT&CK T1059.001: PowerShell execution
• MITRE ATT&CK T1055: Process Injection (all sub-techniques)
• MITRE ATT&CK T1546.003: WMI Event Subscription persistence
• MITRE ATT&CK T1620: Reflective Code Loading
• Microsoft AMSI Documentation: https://learn.microsoft.com/en-us/windows/win32/amsi/
• PowerShell Logging: https://learn.microsoft.com/en-us/powershell/scripting/windows-powershell/wmf/whats-new/script-logging

references/workflows.md (verbatim)

Workflows

Fileless Attack Detection

[Enable telemetry (Sysmon, PS logging, AMSI)] → [Build detection rules per technique]
  → [Deploy rules in SIEM] → [Threat hunt for historical fileless indicators]
  → [Triage alerts] → [Investigate memory for confirmed incidents]
  → [Extract IOCs from memory analysis] → [Tune detections]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.