Why Your AV + EDR Stack Still Misses Fileless Malware

If your security stack is antivirus plus EDR with no 24/7 SOC behind it, there is a category of attack running straight through it right now.

Fileless malware never shows up as a file. It runs entirely in memory, borrowing tools that are already installed and already trusted on the machine. There is no executable to quarantine, no signature to match, and often no trace left on disk at all.

Most MSPs assume that having both antivirus and EDR deployed means this is covered. That assumption is precisely what fileless malware is designed to exploit.

This article breaks down what fileless malware actually is, how it works, why antivirus and even capable EDR tools struggle with detecting fileless malware, and what it takes to close the gap for real.

What is Fileless Malware?

Fileless malware is malicious code that executes in a computer’s memory rather than installing itself on the hard drive. Instead of dropping its own program, it hijacks legitimate software that is already present on the system and uses those tools to carry out the attack.

The tools it abuses are ordinary parts of Windows that IT teams use every day:

• PowerShell, the built-in scripting and automation tool administrators use to manage systems at scale
• Windows Management Instrumentation (WMI), a management framework for querying and controlling machines remotely
• Office macros, small scripts embedded in Word or Excel documents

Because these tools are legitimate, signed, and expected to be running, the malicious activity blends into normal administrative work. Effective fileless malware detection has to focus on behavior rather than files, not on what arrived on disk.

How It Differs From Traditional Malware

A useful way to think about it: traditional antivirus checks IDs at the door. It compares each file arriving on the system against a list of known threats and blocks the ones it recognizes.

Fileless malware never walks through that door. It is already inside the building, using keys the building handed out. Nothing arrives to be checked, because the attacker is operating the tools you already gave your own administrators.

That distinction is not academic. It determines whether your existing tools have any chance of seeing the attack at all.

Why Traditional Antivirus Can’t Catch It

Antivirus works by scanning files and matching them against signatures, essentially fingerprints of known malicious code. It is very good at this. The problem is that fileless malware never writes a file to disk, so there is no fingerprint to take.

This is worth stating plainly: it is not a defect in your antivirus product, and switching vendors will not solve it. It is a category mismatch. A signature-based tool cannot detect something that has no signature, in the same way a metal detector cannot find a plastic object. The tool is working exactly as designed. The threat was simply built to operate outside what it was designed to see.

To be clear about what that does not mean: antivirus still belongs in the stack and it is required. Signature, hash, and file-behavior detection catch an enormous volume of commodity threats every day, and nothing here argues for removing that layer. Blackpoint does not replace it; AV covers the file-based category, and fileless attacks were purpose-built to live outside it.

Where Standard EDR Still Falls Short

Endpoint detection and response is a real improvement. Rather than scanning files, EDR monitors what programs actually do, which gives it a genuine chance against memory-resident attacks.

But not all EDR is the same, and this is where many MSPs find a second gap.

• Telemetry is not detection. Plenty of EDR tools will faithfully log that PowerShell executed an encoded command. Generating that signal is the easy part. Recognizing it as an attack, and responding to it before the operator can pivot, persist, or move laterally, is a separate problem, and a much harder one.
• EDR doesn’t look for tradecraft. Most tools evaluate events in isolation: this process, this command, this connection. Attackers don’t work in isolated events. They follow a playbook, and the sequence is what gives them away. A tool scoring individual actions will rate each step as unremarkable while the campaign runs to completion around it.
• An alert is not a response. Even a correct detection is just another line in a queue if no one is behind it. For an MSP already fielding alerts across dozens of client environments, more alerts do not mean more security. They mean more fatigue, and a better chance the one that matters gets dismissed as noise on a Friday afternoon.

The gap is not only detection technology. It is human coverage and response. Nobody is watching or acting at 2am.

Living-Off-the-Land Techniques Explained

Security teams call this approach “living off the land.” Instead of bringing their own tools, attackers survive on what they find already installed.

The most commonly abused tools in living off the land attacks include:

• PowerShell, for executing commands, downloading payloads into memory, and moving through a network
• Windows Management Instrumentation (WMI), for remote execution and establishing persistence
• Registry Run Keys, for surviving a reboot without leaving a file behind
• Command Prompt, for reconnaissance and chaining together further actions

The appeal for attackers is obvious. These tools are pre-installed, digitally signed by Microsoft, and already permitted by application allowlists. Blocking them outright is not an option, because your own technicians rely on them daily. That is exactly what makes malicious use so difficult to separate from legitimate administration.

Blackpoint’s SOC tracked this pattern directly in a DarkGate campaign that abused living-off-the-land tools, where attackers chained trusted utilities together to operate without triggering conventional defenses.

Common Fileless Entry Points

Fileless malware attacks typically begin in one of four ways:

• Malicious Office macros. A user enables content on a document that looks routine, and the macro launches a script directly into memory.
• Phishing emails containing scripts. Rather than attaching an executable that would be scanned and blocked, the attacker sends a link or file that triggers a script.
• Exploited remote access or RMM tools. Compromised remote management software is particularly damaging for MSPs, because that tooling often has privileged reach into many client environments at once.
• Compromised credentials. With valid credentials, an attacker does not need malware at all. They can simply log in and start using administrative tools as though they belong there. Blackpoint’s SOC has documented this pattern in cases involving PowerShell-based credential theft.

For an MSP, the RMM and credential paths deserve particular attention. Both scale badly. One compromise can reach across your entire client base.

Real Incidents Blackpoint’s SOC Has Tracked

These are not textbook scenarios. Blackpoint’s SOC and Adversary Pursuit Group have tracked each of these in live partner environments, and what they find feeds directly back into detection.

SocGholish has been active for more than five years and remains one of the clearest examples of the technique. It arrives through compromised websites disguised as a routine browser update, then executes JavaScript in memory to establish a foothold. There is no installer for antivirus to catch.

DarkGate demonstrates the living-off-the-land approach at full maturity, chaining trusted administrative utilities together to move through an environment and stage data for exfiltration.

PowerShell-based credential theft rounds out the picture, showing how attackers use built-in tooling to harvest credentials and expand access without ever deploying recognizable malware.

The operational result of tracking tradecraft rather than artifacts is measurable. According to the 2026 Annual Threat Report, Blackpoint’s SOC detected and responded to threats before traditional EDR agents alerted 72% of the time.

What Actually Closes the Detection Gap?

Closing this gap means shifting the question from “what file is this?” to “what is this process actually doing, and what does it look like it is building toward?”

Behavior-based detection looks at sequences and context rather than fingerprints. A PowerShell process spawned by a Word document, reaching out to an unfamiliar domain, and then attempting to access credential stores is suspicious as a pattern, even though each individual step is technically legitimate.

But technology alone does not finish the job, and this is the part vendors tend to gloss over. Legitimate PowerShell use is constant in any managed environment. Your technicians script things. Your RMM runs automation. A purely automated system tuned aggressively enough to catch every attack will bury you in false positives, and tuned loosely enough to stay quiet will miss real intrusions.

Someone has to judge intent. That judgment call, made quickly and correctly, is what separates a contained incident from a breach.

For most MSPs, the missing piece is not another detection tool. It is a 24/7 human SOC that watches, investigates, and acts, without adding headcount you have to hire, train, and retain.

How Blackpoint’s EDR + 24/7 SOC Catches What AV & EDR Alone Miss

Blackpoint’s approach pairs its unified agent (EDR) with AI trained on real analyst decisions and a 24/7 human-led SOC that catches what traditional AV and EDR alone miss.

The difference in practice is tradecraft detection. Rather than scoring events one at a time, the SOC works from the playbook threat actors actually follow (enumeration, credential abuse, lateral movement), which supplies context that individual alerts cannot. That context is what makes early detection possible, and it is the reason for the 72% figure above.

When something real is found, the SOC acts. Analysts contain the threat on your behalf, and a human is reachable by phone if you have questions. That matters at 2am, when the alternative is an alert sitting in a queue until morning.

For MSP owners, the practical effect is straightforward. The gap closes without adding headcount, and alert fatigue drops because the SOC triages and acts rather than forwarding you more work.

This is EDR plus a SOC monitoring it and it closes a gap in your coverage. It is not another point tool or another dashboard for your team to watch.

Frequently Asked Questions About Fileless Malware

What is fileless malware?

Fileless malware is malicious code that runs entirely in a computer’s memory instead of installing a file on the hard drive. It abuses legitimate tools already on the system, like PowerShell, WMI, and Office macros, to carry out attacks. That’s why traditional antivirus often misses it.

How does fileless malware get onto a system?

Fileless malware usually arrives through phishing emails, malicious Office macros, or compromised remote-access tools. Instead of dropping a file, it launches directly in memory and hijacks built-in system tools to run its commands, leaving little or no trace on disk for scanners to find.

How does a fileless malware attack differ from traditional malware?

Traditional malware installs a file on the hard drive, which antivirus can scan and flag. A fileless malware attack runs in memory using trusted system tools like PowerShell, so there’s no file to detect. This makes fileless attacks stealthier and harder to catch with signature-based tools.

Can antivirus detect fileless malware?

Traditional antivirus usually cannot detect fileless malware. Antivirus works by scanning files for known signatures, but fileless malware never writes a file to disk, so there is nothing for a signature-based scanner to catch. Detecting it requires monitoring behavior and memory activity, not files.

Can EDR detect fileless malware?

EDR can detect fileless malware more reliably than antivirus because it monitors behavior, meaning what a program does, rather than scanning for files. Effectiveness varies, though. Basic EDR may log the activity without flagging it, so detecting fileless attacks often still requires behavioral analysis and human review. That’s where a 24/7 AI-accelerated SOC comes into play as previously discussed.

Can fileless malware be detected?

Yes, fileless malware can be detected, but not by traditional file-scanning tools. Because it runs in memory and uses trusted system tools, it’s caught by monitoring behavior, such as unusual PowerShell activity, suspicious process chains, or memory anomalies, combined with human analysts who can tell a real attack from normal IT work.

Is fileless malware easier to detect than traditional malware?

No, fileless malware is harder to detect than traditional malware because it leaves no files to scan and blends in with legitimate system activity. Since it uses trusted tools like PowerShell, its actions can look like normal IT work, so detection depends on analyzing behavior and intent rather than matching known file signatures.

How do you get rid of fileless malware?

Because fileless malware lives in memory, restarting the affected system can remove the active process, but that alone won’t stop reinfection. Full remediation means identifying the entry point, closing it, resetting compromised credentials, and monitoring for persistence mechanisms the attacker may have left behind in scheduled tasks or the registry.

Not Sure If Your Stack Has This Gap?

Most MSPs running antivirus and EDR have never tested whether that combination would actually catch an attacker operating entirely through PowerShell at three in the morning.

If you want to find out where your coverage actually ends, see how Blackpoint closes the fileless and living-off-the-land gap your current stack leaves open.

See how Blackpoint’s CompassOne MDR platform components work together to protect endpoints, identities and more · Contact our team

Request a Demo →