flowchart TD

    FM[Fileless Malware]

    FM --> W[Windows Fileless Malware]
    FM --> L[Linux Fileless Malware]

    W --> WE[Execution]
    W --> WP[Persistence]
    W --> WL[Living-off-the-Land]

    WE --> W1[PowerShell]
    WE --> W2[WMI]

    WP --> W3[Registry]
    WP --> W4[Scheduled Tasks]

    WL --> W5[mshta.exe]
    WL --> W6[regsvr32.exe]
    WL --> W7[rundll32.exe]

    L --> LE[Execution]
    L --> LP[Persistence]
    L --> LL[Living-off-the-Land]

    LE --> L1[Bash]
    LE --> L2[Python]
    LE --> L3[memfd_create]
    LE --> L4[Reflective ELF Loading]

    LP --> L5[Cron]
    LP --> L6[Systemd]

    LL --> L7[curl]
    LL --> L8[wget]
    LL --> L9[ssh]

    style W fill:#cfe8ff,stroke:#2563eb
    style L fill:#d9f7d9,stroke:#16a34a

Loading

Fileless Malware Cookbook

   

📖 Contents

• My Other Awesome Lists
• Contributing
• Contributors

Linux Fileless Malware

flowchart TD

    FM[Linux Fileless Malware]

    FM --> E[Execution]
    FM --> P[Persistence]
    FM --> L[Living-off-the-Land]
    FM --> D[Defense Evasion]

    E --> E1[Bash]
    E --> E2[Python]
    E --> E3[Perl]
    E --> E4["memfd_create()"]
    E --> E5[In-Memory ELF Loading]

    P --> P1[Cron Jobs]
    P --> P2[Systemd Services]
    P --> P3[SSH Authorized Keys]
    P --> P4[Shell Profiles]

    L --> L1[curl]
    L --> L2[wget]
    L --> L3[ssh]
    L --> L4[bash]

    D --> D1[Memory-Only Execution]
    D --> D2[Process Masquerading]
    D --> D3[Packed Scripts]
    D --> D4[Reflective Loading]

Loading

Windows Fileless Malware

flowchart TD

    FM[Windows Fileless Malware]

    FM --> E[Execution]
    FM --> P[Persistence]
    FM --> L[LOLBins]
    FM --> D[Defense Evasion]

    E --> E1[PowerShell]
    E --> E2[WMI]
    E --> E3[.NET Reflection]
    E --> E4[Process Injection]

    P --> P1[Registry Run Keys]
    P --> P2[Scheduled Tasks]
    P --> P3[WMI Event Subscription]

    L --> L1[mshta.exe]
    L --> L2[regsvr32.exe]
    L --> L3[rundll32.exe]
    L --> L4[certutil.exe]

    D --> D1[Memory-Only Payloads]
    D --> D2[Script Obfuscation]
    D --> D3[Trusted Processes]

Loading

My Other Awesome Lists

You can access the my other awesome lists here

Contributing

Contributions of any kind welcome, just follow the guidelines!

Contributors

Thanks goes to these contributors!

🔼 Back to top