Fileless malware
Malicious code that runs entirely in memory without writing an executable file to disk — which makes it invisible to traditional file-based antivirus. It lives in RAM, PowerShell sessions, or hides persistence in the registry/WMI.
Mechanic: instead of dropping a .exe on disk (which antivirus can scan), the code is injected directly into the memory of a legitimate process, run via PowerShell/scripts, or stored in unusual hiding spots (the Windows registry, the WMI database, scheduled tasks) to survive reboots. Since there's no file to signature-match, classic AV misses it. Tightly interwoven with living-off-the-land (use built-in tools) — often the whole chain is fileless. Defense: behavior-based/memory-scanning EDR (look at what happens in RAM and how processes behave), monitor PowerShell and script-host activity, and block suspicious memory injection. A response to signature-based protection becoming too easy to bypass. A dominant technique in modern intrusions. Related to living off the land and indicator of compromise.