In this series of articles, we provide an in-depth discussion of fileless malware and their related attacks. Fileless malware is intended to be memory resident only, leaving no trace after its execution. The malicious payload exists dynamically and purely in RAM, which means nothing is ever written directly to the HD. The purpose of all this for the attacker is to make post-infection forensics difficult. This form of attack makes it nearly impossible for antivirus signatures to trigger a detection. In some cases, as with SamSam, the only way to even retrieve a sample would be to catch the attack happening live.”]