An Assistive Tool For Fileless Malware Detection

Abstract

While fileless and file-based malware attacks are two completely different approaches, even their assistance and detection tools vary. Fileless malware executes in a non-traditional way without leaving traces on the file system, thus evading detection engines. They are powerful because of their persistence and evasion methods. To analyze such malware, we propose an assistive tool for forensic examiners. It assists in identifying abnormal process, network and system activities. This paper also presents background knowledge of fileless life cycle and infection methods.