File-less Malware Bypassing Application Whitelisting

System Hacking

Answer Correct answer: A — File-less malware bypasses application whitelisting by operating in memory using legitimate, whitelisted system tools.

Security administrator John Smith has noticed abnormal amounts of traffic coming from local computers at night. Upon reviewing, he finds that user data have been exfiltrated by an attacker. AV tools are unable to find any malicious software, and the IDS/IPS has not reported on any non-whitelisted programs. What type of malware did the attacker use to bypass the company’s application whitelisting?

File-less malware Correct Answer
Zero-day malware
Phishing malware
Logic bomb malware

Community Votes

60%

40%

60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The core concept tested is distinguishing between malware types based on their persistence mechanism and detection profile; the common trap is selecting 'Zero-day' simply because it is undetected, ignoring that zero-days can still be file-based and thus trigger whitelisting checks if the binary isn't known.

This question addresses file-less malware, which operates in memory using legitimate system tools to bypass traditional AV and application whitelisting. The correct answer is A because it specifically explains the evasion of non-whitelisted program detection by leveraging existing trusted binaries.

Many learners choose Zero-day malware (B) because the scenario mentions no detection, but this ignores the specific constraint about 'non-whitelisted programs.' File-less malware evades this by using whitelisted processes (like PowerShell), whereas a zero-day file would still be a new executable potentially flagged by behavioral analysis or lack of whitelist status.

Community Discussion (5 comments)

000f1d9 👍 1 Selected: A

Fileless malware are associated with "live off the land" intrusions, which utilize whitelisted applications, for example powershell, to avoid detection. Also, they can employ malware in techniques that aren't stored to disk, only run in memory, like a remote execution of Powershell scripts like invoke-mimikatz to harvest credentials. These are not "zero day" malware, since they are either 1. legitimate tools being abused, 2. known malware running in memory.

Fiete 👍 1 Selected: B

We have two criteria: - AV tools are unable to find any malicious software This could apply to both a file-less (in-memory) malware and zero-day malware. - the IDS/IPS has not reported on any non-whitelisted programs The wording seems to indicate that this is a host-based IDS/IPS that links packets to processes and their executable files and then reports if any non-whitelisted executable sends packets. For a file-less malware the executable would be <empty> which is most certainly not whitelisted. A zero-day malware could simply embed itself into an already whitelisted executable (e.g. chrome.exe) and would not trigger an alert. Therefore: B

killwitch 👍 1 Selected: A

File-less malware is a type of malicious software that operates without relying on traditional files. Instead of installing executable files, file-less malware typically exploits system vulnerabilities or runs in-memory, often through scripting languages or legitimate system tools. Because it doesn't rely on files, it can bypass traditional antivirus (AV) tools and application whitelisting mechanisms that focus on detecting file-based threats. In this case, the fact that AV tools couldn't detect any malicious software and the IDS/IPS didn't flag any non-whitelisted programs suggests that the malware did not rely on traditional files but instead operated directly in memory, making it difficult to detect and block.

marcel9999 👍 1 Selected: B

Zero day because not recognized bypass all detections

SukhoiF35 👍 1 Selected: B

Malware wasn't recognised by any AV or IPS/IDS. File-Less malware exfiltration can be detected with IPS

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The correct answer is A — File-less malware. This type of malware does not write files to disk, instead residing entirely in memory and often executing via legitimate system utilities (e.g., PowerShell, WMI). Because it utilizes these pre-approved, whitelisted applications to perform malicious actions, it successfully bypasses application whitelisting mechanisms that only check for unauthorized executables. It also evades signature-based AV tools since there is no malicious file to scan.

Why the Other Options Are Wrong

Option B (Zero-day malware) is incorrect because a zero-day refers to the vulnerability's age, not the malware's delivery method; a zero-day could still be a file-based exploit that triggers whitelisting alerts if the payload isn't trusted. Option C (Phishing malware) describes a delivery vector (social engineering) rather than the technical evasion technique itself. Option D (Logic bomb malware) is triggered by specific conditions and typically involves file-based code execution, making it susceptible to whitelisting rules.

Community Comment Notes

Community members correctly identified that file-less malware leverages "live off the land" techniques, as noted by user 000f1d9 who highlighted the use of whitelisted applications like PowerShell. User marcel9999 argued for Zero-day due to lack of recognition, but failed to account for the specific whitelisting context. User SukhoiF35 incorrectly claimed IPS detects file-less exfiltration, which is debatable depending on configuration, but the primary defense against file-less threats is often endpoint detection and response (EDR) rather than traditional network IPS.

Exam Strategy

When analyzing malware questions, look for keywords like 'memory-only', 'no file on disk', or 'using legitimate tools'. These point directly to file-less malware. If the question emphasizes 'new vulnerability' without mentioning execution methods, consider zero-day, but always cross-reference with detection constraints like whitelisting.

Frequently Asked Questions

Why isn't Zero-day the right answer if nothing detected it?

Zero-day refers to an unknown vulnerability, not the execution method. File-less malware specifically exploits whitelisting by using trusted apps, which fits the scenario better.

How does file-less malware evade AV tools?

It resides in memory and uses legitimate system binaries, so there is no malicious file signature for traditional AV to detect on disk.

More 312-50v13 FAQ →

Related Analysis

← Back to 312-50v13 Study Guide