The End of the Signature Era: Adapting to 79% Malware-Free Attacks
Just saw the latest stats from the CrowdStrike Global Threat Report, and honestly, it confirms what many of us have feared: the arms race has fundamentally changed. The report highlights that 79% of attacks are now malware-free, driven largely by AI-equipped threat actors who can adapt faster than our signature databases can update.
We aren't just dealing with shady .exe downloads anymore; we're facing adversaries leveraging valid credentials, LOLBins (Living Off the Land Binaries), and cloud APIs. Relying solely on endpoint telemetry is a recipe for disaster. If we're not correlating network traffic with identity logs, we're flying blind.
I've been shifting our detection logic to focus on "anomaly over signature." For instance, instead of just flagging known bad hashes, we're hunting for LOLBin usage with contextual weirdness. Here is a KQL query I've been tuning in Sentinel to catch PowerShell execution chains that don't fit a standard admin profile:
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "DownloadString", "IEX")
| where InitiatingProcessFileName !in ("explorer.exe", "services.exe")
| project DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
This helps catch the "malware-free" execution chains that still rely on PowerShell for C2 or payload staging. But even this feels reactive.
How are you all building your layers? Are you leaning into deception technology to trip up AI Recon, or are you seeing better ROI with strict identity governance (IAM) monitoring?
We’ve started moving away from pure EDR alerts and focusing heavily on Identity layer detection. If 79% of attacks are malware-free, they're almost certainly abusing credentials. We implemented a detection rule for 'Impossible Travel' scenarios combined with unusual MFA fatigue attempts.
It’s caught three sophisticated phishing attempts in the last month that had zero malware footprint. You can have the best EDR in the world, but if they have a valid token, it's game over without strict Conditional Access policies.
Solid KQL snippet. One thing I'd add is filtering for non-interactive sessions. Malware-free attacks often use scheduled tasks or WMI event consumers to maintain persistence without a user logged in.
Here is a quick sysmon config addition we use to catch this:
powershell.exe;cmd.exe
This gives us visibility into the 'fileless' persistence mechanisms that usually fly under the radar.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access