Living-off-the-Land and Fileless Malware

• Abuse legitimate, signed OS binaries (LOLBins): powershell.exe, rundll32.exe, regsvr32.exe, mshta.exe, wmic.exe.
• Fileless: payload lives in memory, registry, or scheduled tasks — little or nothing on disk.
• Goal: blend into normal admin activity and evade signature-based antivirus.
• Detection shifts from "what file is this?" to "what behavior is this?" — process trees, command lines, parent/child anomalies.
• This is exactly why Lab 4 builds a behavioral detector.