SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-fileless-and-in-memory-threats
0
Hunts for fileless and in-memory threats by correlating PowerShell script-block logs, encoded-command usage, in-memory loading patterns, and registry-resident payloads from Windows telemetry. Activates for requests to hunt fileless malware, detect in-memory execution, or find registry-resident and reflective-loading activity.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting Fileless and In-Memory Threats ## When to Use - You have PowerShell script-block logs (4104), process telemetry, and registry-write events and want to detect fileless execution that leaves little on disk. - You are hunting reflective loading, in-memory .NET execution, and registry-resident payloads. **Do not use** this to alert on all PowerShell use — hunt the in-memory loading and encoded-payload patterns specifically. ## Prerequisites - 4104 script-block logs and/or process and registry telemetry (CSV/JSON). ## Workflow ### Step 1: Hunt in-memory loading patterns ```bash python scripts/analyst.py hunt events.csv ``` Flags `[Reflection.Assembly]::Load`, `VirtualAlloc`/`WriteProcessMemory` via PowerShell, `Invoke-Expression` of decoded blobs, `DownloadString`+`IEX`, and large base64 in script blocks. ### Step 2: Detect registry-resident payloads Surface writes of large encoded blobs to `HKCU\Software\...` Run-adjacent or custom keys (fileless storage). ### Step 3: Confirm Correlate script-block content with the parent process and subsequent network/child activity. ### Step 4: Operationalize Write detections for reflective loading and base64-heavy script blocks. ## Validation - Flags are based on in-memory loading/encoded-payload patterns, not PowerShell presence. - Registry-resident payload detection keys on large encoded values. - Findings map to ATT&CK T1620/T1059.001/T1112. ## Pitfalls - Legitimate admin scripts using `Invoke-Expression` — corroborate with content/parent. - Obfuscated script blocks splitting indicators across logs. - Constrained Language Mode evasions changing the observable API surface. ## References - See [`references/api-reference.md`](references/api-reference.md) for the hunter. - ATT&CK T1620 and script-block logging docs (linked in frontmatter).