Breaking the Kill Chain: Defending Against 79% of Software-Free Intrusions

The days of relying solely on signature-based antivirus to stop intrusions are effectively over. According to the latest CrowdStrike Global Threat Report, approximately 79% of attacks are now malicious software-free. This isn't a minor shift in tactics; it is a fundamental paradigm shift in the threat landscape.

AI-equipped adversaries are not just improving malware; they are bypassing the concept of "malware" entirely. By leveraging pre-installed system tools, authorized scripts, and valid credentials, these actors operate within the noise of normal business operations. For Security Operations Centers (SOCs), this means the traditional indicators of compromise (IOCs)—malicious hashes and dropped executables—are increasingly disappearing. We are facing an invisible enemy, and our detection layers must evolve immediately to account for behaviors, not just binaries.

Technical Analysis

The Threat Vector: Living Off the Land (LotL)

The core of this "software-free" surge is the reliance on Living Off the Land binaries (LOLBins) and fileless techniques. Rather than dropping a payload that triggers an alert, attackers utilize tools that are already signed by Microsoft or Unix vendors.

• Affected Platforms: Windows (PowerShell, WMI, Certutil), Linux (Bash, SSH, Cron), and Cloud environments.
• Methodology: Attackers use AI to rapidly generate obfuscated PowerShell commands or schedule tasks that execute code directly in memory. They use tools like regsvr32.exe or mshta.exe to fetch remote payloads without writing them to disk, effectively bypassing traditional file-scanning engines.
• Exploitation Status: This technique is not theoretical. It is the dominant Initial Access and Execution vector observed in 2026 intrusion sets, ranging from hands-on-keyboard ransomware operations to automated AI-driven botnets.

Why Defenses Are Failing

Legacy EDR and AV solutions look for file reputations. When an attacker uses a signed binary like powershell.exe to run a script that lives only in RAM, the file reputation is clean. The only way to detect this is by analyzing the argument passed to the binary and the subsequent behavioral chain—network connections established by that script, or registry keys modified by the process.

Detection & Response

To catch software-free attacks, we must hunt for anomalies in how legitimate tools are used. We are looking for the "weaponization" of administrative utilities.

SIGMA Rules

These rules target the abuse of LOLBins commonly used in file-free attacks.

---
title: Suspicious PowerShell EncodedCommand Usage
id: 8a5d9a23-1f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects the use of PowerShell with encoded commands, a common method to obfuscate malicious scripts in software-free attacks.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-EncodedCommand '
      - '-Enc '
      - '-encode '
  condition: selection
falsepositives:
  - System management scripts that use encoding (rare in production)
level: high
---
title: Suspicious Certutil Decode Usage
id: 9b4e1c82-0e4b-4d67-bc12-3e5a8f901235
status: experimental
description: Detects certutil being used to decode files, often used to dump malicious payloads from steganography or base64 encoding.
references:
  - https://attack.mitre.org/techniques/T1140
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.defense_evasion
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - '-decode'
      - '/decode'
      - '-decodehex'
      - '/decodehex'
  condition: selection
falsepositives:
  - Administrative decoding operations (verify context)
level: medium

KQL (Microsoft Sentinel)

This query correlates a suspicious process launch with an immediate network connection, a hallmark of fileless command-and-control (C2) activity.

// Hunt for LOLBins initiating network connections
let SuspiciousProcesses = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe"]);
DeviceProcessEvents
| where FileName in~ (SuspiciousProcesses)
| where ProcessCommandLine matches regex @"(\-enc|\-e |\-w hidden|\-c |DownloadString|Invoke-Expression|IEX)"
| join kind=inner (
    DeviceNetworkEvents
    | where InitiatingProcessFileName in~ (SuspiciousProcesses)
    | where RemotePort in (443, 80, 8080)
    | summarize arg_max(Timestamp, *) by InitiatingProcessId, DeviceName
) on DeviceName, InitiatingProcessId
| project Timestamp, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP

Velociraptor VQL

This artifact hunts for processes running from temporary directories or spawned by unusual parent processes, which often indicates fileless execution.

-- Hunt for LOLBins running from suspicious locations
SELECT Pid, Name, CommandLine, Exe, Username, ParentPid
FROM pslist()
WHERE Name IN ('powershell.exe', 'cmd.exe', 'wscript.exe', 'mshta.exe', 'regsvr32.exe')
  AND (
      Exe =~ 'C:\\Windows\\Temp\\.*'
      OR Exe =~ 'C:\\Users\\Public\\.*'
      OR Exe =~ '\\AppData\\Local\\Temp\\.*'
  )

Remediation Script (PowerShell)

Use this script to harden the PowerShell environment against common obfuscation and injection techniques used in software-free attacks.

# Harden PowerShell against software-free attacks
Write-Host "Hardening PowerShell Environment..." -ForegroundColor Cyan

# 1. Enable Module Logging and Script Block Logging (Critical for forensics)
$Path = "HKLM:\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging"
if (-not (Test-Path $Path)) { New-Item -Path $Path -Force | Out-Null }
Set-ItemProperty -Path $Path -Name "EnableScriptBlockLogging" -Value 1 -Force

$ModulePath = "HKLM:\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging"
if (-not (Test-Path $ModulePath)) { New-Item -Path $ModulePath -Force | Out-Null }
Set-ItemProperty -Path $ModulePath -Name "EnableModuleLogging" -Value 1 -Force
Set-ItemProperty -Path $ModulePath -Name "ModuleNames" -Value "*" -Force

# 2. Disable PowerShell v2 (Deprecated and often abused)
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 -NoRestart -ErrorAction SilentlyContinue

Write-Host "Hardening complete. Script Block Logging is now enforced." -ForegroundColor Green

Remediation

Addressing the software-free threat landscape requires architectural changes, not just a patch.

1. Enable Deep Visibility: Ensure Script Block Logging and Module Logging are enforced via Group Policy (GPO) or Intune across all endpoints. Without these logs, PowerShell attacks are invisible.
2. Strict Application Control: Implement Microsoft Defender Application Control (WDAC) or AppLocker. Instead of blocking bad files, allow only known-good binaries. This effectively stops the "Living Off the Land" technique by restricting which tools can run.
3. Least Privilege: Aggressively remove local administrator rights from standard users. Most software-free lateral movement techniques require admin rights to manipulate WMI or the registry.
4. Network Segmentation: Isolate critical workstations. If a software-free attack jumps from a user endpoint to a server, network segmentation can break the kill chain.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub