Fileless Attacks

In 2015, a threat actor group known as Carbanak ran a series of attacks against financial institutions that left security teams baffled. The group breached banks across 30 countries, moved laterally through internal networks, and exfiltrated an estimated $500 million in transfers, all without leaving a single suspicious binary on disk. Every AV product in those environments stayed quiet. The attack was carried out almost entirely through PowerShell, WMI, and other tools that were already installed on every machine in the environment.

This is not an edge case. FIN7's campaigns against retail and hospitality enterprises, APT29's intrusions into government networks, and countless ransomware deployments since then have all shared the same pattern: attackers operating through trusted, native Windows tooling rather than carrying their own executables. Traditional endpoint protection was built to scan files. If there are no suspicious files, it has nothing to find.

Learning Objectives

• Explain the fileless attack spectrum and distinguish between memory-resident, LOLBin, and script-based categories
• Execute PowerShell in-memory payloads using IEX, download cradles, and encoded command techniques
• Bypass AMSI using string concatenation, memory patching, and reflection-based methods
• Abuse native Windows binaries (mshta, rundll32, regsvr32, certutil, wmic) for payload execution without dropping a PE to disk
• Understand the named pipe mechanism underlying psexec-style remote execution and demonstrate why smbexec avoids dropping a binary on the target
• Execute classic shellcode injection use Meterpreter's migrate command to blend into a legitimate process

Prerequisites

• Windows CLI: Comfortable running commands in cmd.exe and PowerShell
• Windows PowerShell: Understanding of variables, objects, and basic scripting
• Core Windows Processes: Understanding of processes, threads, and memory

Machine Access

Start the lab by clicking the Start Lab Machine button below. The Windows VM at MACHINE_IP needs about two minutes to fully load. All exercises run from the AttackBox against this target.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Attacker machine

Status:Off

Lab machine

Status:Off

Start Lab Machine

Credentials for the Windows VM are below: