312-50 Question 169
Single answer▪ Fileless Malware ConceptsDuring an internal compromise assessment, a SOC analyst reports that several Windows 10 endpoints launched powershell.exe from WINWORD.EXE immediately after users opened a phishing document. EDR telemetry shows the PowerShell process used the flags -nop -w hidden and executed a long Base64-encoded command. No malicious executable was written to disk, but the affected hosts made outbound connections to an unfamiliar IP over HTTPS. Which finding most strongly indicates a fileless malware attack rather than a traditional malware infection?
- A
The attack relies on in-memory PowerShell execution launched by a trusted application, with little or no malicious payload written to disk
- B
The outbound connection uses HTTPS, which means the traffic is encrypted and therefore fileless
- C
The phishing document was opened in Microsoft Word, which confirms the malware is macro-based and not fileless
- D
The absence of a dropped .exe proves the activity is benign administration rather than malware
Show answer and explanation
Correct answer: A
Explanation
Fileless malware is characterized by execution that primarily leverages legitimate system tools and memory-resident payloads instead of relying on a traditional malicious file on disk. In this scenario, the strongest indicator is Office spawning PowerShell with stealth and obfuscation flags, then executing an encoded command and establishing outbound communication. This aligns with commonly documented fileless techniques such as PowerShell abuse and living-off-the-land behavior. MITRE ATT&CK documents related techniques including PowerShell (T1059.001), Command and Scripting Interpreter, User Execution (T1204), and malicious use of signed or trusted system binaries. Microsoft security guidance and incident response best practices also note that encoded PowerShell, hidden windows, suspicious Office-to-script-child-process relationships, and memory-focused execution are high-value indicators for fileless attacks. Analysts should validate with script block logging, AMSI telemetry, parent-child process analysis, command-line auditing, memory inspection, and network correlation rather than depending only on disk-based antivirus detection.
- A. Correct.
Correct. Fileless malware commonly abuses legitimate tools such as PowerShell, WMI, or rundll32 to execute malicious logic directly in memory. A parent-child chain such as WINWORD.EXE spawning powershell.exe, combined with obfuscation flags like -nop and -w hidden and an encoded command, is a classic indicator of fileless tradecraft. The key concept is that the attacker minimizes or avoids writing a conventional malicious binary to disk, making signature-based file scanning less effective.
- B. Incorrect.
Incorrect. HTTPS only describes the transport protocol and encryption of network traffic. Many forms of malware, including traditional malware that drops binaries to disk, use HTTPS for command-and-control. Encrypted traffic does not indicate whether malware is fileless.
- C. Incorrect.
Incorrect. A phishing document can be used to trigger either traditional malware or fileless activity. Malicious macros often serve as an initial execution mechanism that launches a living-off-the-land binary such as PowerShell. Therefore, the presence of Word or a macro-enabled document does not rule out fileless malware; it may be the delivery vector for it.
- D. Incorrect.
Incorrect. Attackers frequently avoid dropping .exe files specifically to evade detection, but that does not make the behavior benign. In enterprise environments, hidden PowerShell launched by Office with encoded commands is suspicious and often associated with malicious activity. Legitimate administration can use PowerShell, but the surrounding context here strongly suggests abuse.