Story image

Exclusive: Fileless malware driving uptake of behavioural analytics

12 Nov 18

Article by LogRhythm Asia Pacific and Japan senior regional marketing director Joanne Wong

Over the past year, a new form of malware has emerged that is able to more successfully evade traditional detection and defence techniques.

As a result, it is seeing increased use by attackers in the wild, and if the amount of research being devoted to it right now is any indication, security practitioners are sufficiently worried.

Most organisations and users are across vectors that malware typically uses to spread - dodgy file attachments, infected USB drives and the like.

This malware works by storing its payload on disk as an executable file or script that is then unleashed.

Antivirus software is designed to detect the creation of these types of files and check them against signatures of known malware.

If malware is detected, the file is deleted or quarantined before it can execute and cause damage. 

However, a newer strain of malware is “fileless” - that is, it is designed to operate exclusively in computer memory.

To execute, it abuses existing software, applications and authorised protocols on a machine so it can carry out its designated malicious activity.

Fileless malware often finds its way into organisations via web browsers (or in combination with other vectors such as infected USB drives).

For example, a user could visit a compromised page, which then uses Flash to instruct PowerShell to connect to a stealth command and control server where it downloads a malicious script.

Fileless malware was first seen in the wild in April 2015.

An early example targeting local users was JS_POWMET, which hit businesses in the Asia Pacific region.

When JS_POWMET was uncovered in August last year, the researchers involved noted that the rarity of finding a completely end-to-end fileless attack.

Not only did it infect a machine without a trace, but it also left no evidence after the malicious payload had executed, making it very difficult to spot again in the future.

Traditional families of malware are also changing to execute on a fileless basis.

Microsoft researchers noted back in mid-2016 that Kovter, a type of click-fraud malware, had been updated to become “almost fileless”.

The change didn’t completely allow it to avoid detection. 

However, the trend to evolve file-based malware into fileless malware is further evidence of the increasing sophistication of cyber attacks that is making it significantly harder to stop threats from entering corporate networks and devices.

In addition to being triggered through web browsers, fileless malware is also known to exploit Microsoft Office applications and operating systems tools such as PowerShell (which is used to automate administration tasks on Windows), Visual Basic (VB) scripts and Windows Management Instrumentation (WMI).

McAfee uncovered a fileless malware campaign recently called Operation Gold Dragon that targeted the 2018 Winter Olympics, which was described as “an exemplary implementation of PowerShell malware in an attack”.

Fileless elements can also be found in other successful attacks.

Both the Petya and Wannacry ransomware outbreaks last year took advantage of “fileless techniques”, researchers have said.

Existing security strategies that incorporate file-based whitelisting, signature detection, hardware verification, pattern analysis or time stamping just won’t pick up fileless malware.

A potential weakness of fileless malware, however, is that as it works in-memory, it should only remain on the system until it is rebooted.

As a basic first step, regular system reboots are likely to deal with some fileless malware.

However, cybercriminals are now adding persistence to the malware code so that it resumes following a system restart.

Ultimately, the best approach is to use behavioural analytics, which monitor the activity of applications and services, including communications between processes, unauthorised requests to run applications, and changes to credentials or permission levels.

For example, while many of the processes involved in fileless malware entering a network via a web browser are normal in isolation, the fact they happen concurrently is less normal, meaning they can be flagged and shut down before damage is done.

How Adobe aims to drive digital transformation for financial services
Digital transformation is a requirement for ongoing competitiveness that clearly helps businesses run more efficiently.
Using blockchain to ensure regulatory compliance
“Data privacy regulations such as the GDPR require you to put better safeguards in place to protect customer data, and to prove you’ve done it."
Human value must be put back in marketing - report
“Digital is now so widely adopted that its novelty has worn off. In their attempt to declutter, people are being more selective about which products and services they incorporate into their daily lives."
A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
Microsoft NZ bids Goldie a “fond farewell”
Microsoft New Zealand director of commercial and partner business takes new role across the Tasman. The search for his replacement has begun.
Google says ‘circular economy’ needed for data centres
Google's Sustainability Officer believes major changes are critical in data centres to emulate the cyclical life of nature.
One Identity a Visionary in Magic Quad for PAM
One Identity was recognised in the Gartner Magic Quadrant for Privileged Access Management for completeness of vision and ability to execute.