Forensic Visibility of Fileless Malware: Which Artifacts Survive and Which Disappear?

Abstract

Fileless malware and Living-off-the-Land (LOTL) techniques allow adversaries to operate through legitimate system components, script interpreters, and memory-resident execution rather than through a conventional malicious binary. This shift creates a challenge for digital forensics because the reduction of disk-based evidence does not necessarily mean that forensic evidence disappears. This paper synthesizes 19 peer-reviewed and high-quality institutional publications on fileless malware, LOTL abuse, memory forensics, PowerShell and WMI forensic evidence, malware persistence, and provenance-based investigation. The review organizes the literature around volatile memory, Windows event logs, PowerShell and WMI telemetry, registry artifacts, process and command-line records, network evidence, and file-system remnants. It compares the potential persistence of these artifacts with the conditions under which investigators can actually recover them. The analysis shows that forensic visibility depends strongly on logging configuration, acquisition timing, process termination, system reboot, attacker cleanup, and log retention. The paper identifies a recurring distinction between artifact existence and artifact recoverability and proposes a conceptual framework linking technique execution, system interaction, artifact generation, volatility, acquisition timing, cross-source correlation, and investigator interpretation. The study concludes that fileless execution does not eliminate forensic evidence; instead, it shifts the evidence toward sources whose recoverability is highly dependent on preparation and timing. The findings provide practical implications for malware analysts, digital forensic investigators, and security operations teams.