312-50 Question 171
Single answer▪ Fileless Malware ConceptsDuring an internal assessment, a security team notices several Windows endpoints launching PowerShell from WINWORD.EXE shortly after users open a phishing attachment. The EDR shows the PowerShell process used an encoded command, made an outbound HTTPS connection, and injected code into a legitimate process. Disk-based antivirus found no malicious executable on the host. Which observation most strongly indicates the attack is using fileless malware techniques rather than a traditional dropped malware executable?
- A
The malicious activity is executed through PowerShell and in-memory code injection without relying on a malicious file written to disk
- B
The outbound connection uses HTTPS, which means the traffic cannot be inspected and therefore must be fileless malware
- C
The phishing attachment was opened from Microsoft Word, which confirms the attack is a macro virus rather than fileless malware
- D
The endpoint protection platform did not alert, proving the attack does not involve any malware payload
Show answer and explanation
Correct answer: A
Explanation
The best answer is the observation that PowerShell was launched from Word and used encoded commands with in-memory execution and process injection, without a malicious executable being written to disk. That pattern aligns with fileless malware concepts: abusing legitimate system utilities and keeping much of the malicious logic in memory to reduce detectable file artifacts. In real environments, defenders look for behavior chains such as Office spawning PowerShell or cmd.exe, suspicious use of encoded commands, AMSI-relevant script content, unusual parent-child process relationships, and process injection telemetry. This is consistent with guidance from Microsoft security documentation on detecting malicious PowerShell, LOLBins, and fileless techniques, as well as MITRE ATT&CK techniques such as PowerShell (T1059.001), Command and Scripting Interpreter, Process Injection (T1055), and abuse of trusted utilities. Traditional dropped malware often leaves a PE file or script artifact on disk, whereas fileless attacks emphasize memory-resident execution and native tool abuse.
- A. Correct.
Correct. Fileless malware commonly abuses legitimate tools such as PowerShell, WMI, or Office child processes to execute malicious logic directly in memory, often followed by reflective loading or process injection into legitimate processes. The absence of a dropped executable on disk, combined with encoded PowerShell and in-memory execution, is a strong indicator of fileless activity.
- B. Incorrect.
Incorrect. HTTPS is commonly used by many forms of malware and legitimate applications. Encrypted outbound traffic alone does not indicate fileless malware. While it may complicate inspection, the defining characteristic here is memory-resident execution using trusted system tools rather than the protocol used for command-and-control.
- C. Incorrect.
Incorrect. Opening a malicious document in Word does not by itself prove the attack is a macro virus, nor does it exclude fileless techniques. Office documents are often just the initial execution vector. A malicious macro can launch PowerShell or other LOLBins to execute payloads in memory, which is consistent with fileless malware behavior.
- D. Incorrect.
Incorrect. Lack of an alert does not prove there is no malware payload. Fileless malware often evades traditional signature-based detection precisely because it avoids leaving a conventional file artifact on disk. The observed behavior still indicates malicious execution, even if the endpoint protection platform missed it.