Script-Based and Fileless Malware

• "Fileless" means little or no malicious binary on disk — the payload lives in memory, the registry, or is downloaded on demand.
• Delivery is often a script, not a compiled file:
• PowerShell: encoded commands, download cradles, in-memory execution.
• JScript / VBScript: macros, .js/.vbs droppers, HTA files.
• Goal: minimize disk artifacts, blend into normal admin activity, defeat signature-based AV.
• Detection shifts from "scan the file" to "watch the behavior" (process trees, command lines, script logging).