Lion Cipher Lab

Characterize fileless malware: PowerShell, WMI, and registry when nothing hits disk

• Digital Forensics & IR (DFIR)
• Advanced
• ~50 min
• Free · no account required

Why it matters

The instinct of a new investigator is to find the malicious file — pull the .exe, hash it, submit it to VirusTotal, quarantine it, done. Fileless malware breaks that reflex completely. A whole class of real intrusions writes little or nothing to disk: the malicious code runs directly in memory, and what it needs to survive a reboot is hidden in places antivirus does not scan as files — a registry value, the WMI repository, a scheduled task's command line. Run a full disk scan against a machine like this and it comes back clean, which is exactly the trap: 'clean' meant 'no malicious FILE', not…

What you'll learn

• reading PowerShell script-block logging (Event ID 4104) as the primary evidence when no file exists to scan
• recognising obfuscated in-memory execution: IEX, EncodedCommand, and reflective loading of a PE from a base64 blob
• decoding what a WMI event-subscription persistence (__EventFilter + CommandLineEventConsumer + FilterToConsumerBinding) actually does and when it fires
• spotting the registry-as-storage trick — a base64 payload parked in a registry value instead of a file on disk
• understanding WHY fileless malware defeats file-based antivirus: the code lives in memory, the registry, and the WMI repository, not in a scanned file
• pivoting across PowerShell logs, WMI, the registry, and scheduled tasks to reconstruct an infection with no dropped binary
• mapping fileless behaviour to MITRE ATT&CK (T1059.001 PowerShell, T1546.003 WMI Event Subscription, T1112 Modify Registry, T1620 Reflective Code Loading)
• judgment: when logs and memory are the only evidence, why logging must be enabled beforehand, and when a disk-based hunt tells you nothing

Steps in this lab

1. What 'fileless' means — and why the disk scan lies to you
2. The scenario: an alert with a clean scan
3. Artifact 1 — the disk hunt comes back empty (and what that proves)
4. Artifact 2 — the primary evidence: PowerShell script-block log (Event ID 4104)
5. Artifact 3 — the registry as storage: a base64 payload with no file
6. Artifact 4 — WMI event-subscription persistence (the durable one)
7. Artifact 5 — the belt-and-braces: a scheduled task, encoded
8. When logs and memory are the only evidence — and how a pro handles it

Open the full interactive lab →