TechKnowSurge
CompTIA Security+ 2.4
TechKnowSurge Catalog Interactives Fileless or File-Based?
InteractiveSecurityFree

Fileless or File-Based?

Fileless malware runs in memory; file-based malware sits on the drive. Which is this? Land five in a row.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

What you are doing: deciding whether each piece of malware is fileless or file-based. The lesson’s trade-off: traditional malware is installed on the hard drive. That gives it persistence, because it is still there after a restart, but antivirus software scans the files on the drive, so it is easier to detect. Fileless malware never gets installed as a file; it runs within RAM. Few tools scan memory as closely, so it is harder to detect, but anything that lives only in RAM is lost when the computer restarts. How to use it: ask where the code lives. On the drive, file-based. Only in memory, fileless. Some real fileless families store a small script elsewhere to relaunch themselves; every card here keeps to code that lives only in memory. A wrong answer resets your streak.

What you'll learn

Aligned to

CompTIA Security+
2.4 Given a scenario, analyze indicators of malicious activity.

Key terms

Fileless Malware
Malware that resides in a system's RAM rather than on disk, evading traditional file-based antivirus detection.
Persistence
A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.
Antivirus
Software designed to detect, prevent, and remove malicious software from a system.

Topics

Fileless Malware Persistence Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →