Fileless threats are used in many forms of malicious activity – from advanced targeted attacks to widespread malware campaigns or even generic malware, such as Trojan-clickers and adware. Kaspersky researchers are constantly revealing these threats in various attacks, such as the PowerGhost cryptominer, attacks on banks with DarkVishnya, Turla’s APTs and the Platinum APT. Detection of fileless malware is more complicated than other malware because its malicious code does not store itself on a hard drive. It can exist in memory, registry, OS scheduler tasks or Windows system storages, such as WMI objects.

In its study, AV-TEST examined products for different categories of fileless attacks, including malware execution from WMI storage or by Task Scheduler, running a PowerShell script after the execution of exploits or macros. On top of these, the test also monitored for false positives. Of all the solutions tested, Kaspersky Endpoint Security for Business was the only one to detect all 33 attacks, while the average detection rate of all the products was 67.75%. As for protection and remediation, Kaspersky’s product prevented 48 out of 51 malicious actions, compared to an average protection level of 59.10%. The false positive test revealed no false detection or blocks by the Kaspersky product.