Fileless malware
Fileless malware is malicious activity that runs without writing an executable to disk, operating from memory and from tools already present on the system. It is not a category of malware so much as a set of techniques for avoiding the artefacts that traditional file based detection was built to find.
In practice it means a payload delivered into the memory of a process that is already running and trusted, execution driven by living off the land binaries that ship with the operating system, and whatever persistence is available without a file: a scheduled task with an inline command, a registry value holding an encoded script, or a subscription to a system event that runs a command when it fires.
The reason it works against signature based products is straightforward. There is no file to hash and no unusual binary to flag, and the process doing the work is a legitimate administrative tool that also runs a thousand times a day for good reasons. Detection therefore has to move to behaviour: script block logging, command line arguments, the parent and child relationships between processes, and the telemetry that endpoint sensors collect from memory, which is exactly the ground EDR evasion contests.
For a defender the operational consequence is about evidence rather than prevention. Memory resident activity is lost when the host is rebooted, so an incident response that begins by restarting the machine destroys the only copy of what happened. When we exercise a detection capability, the question we are answering is not whether the tooling can see a known family but whether the logging that would reconstruct this afterwards is switched on and retained, and that is central to the red team work where operator tradecraft is tested against real detection.