Executive Summary: As of Q2 2026, Microsoft Defender’s cloud-delivered protection (CDP) remains a cornerstone of enterprise endpoint security, but a growing class of fileless malware strains has evolved to bypass its behavioral and memory-scanning defenses. These attacks leverage legitimate system processes, in-memory execution, and Microsoft's own cloud telemetry APIs to remain undetected. This report identifies the five most prevalent fileless malware strains exploiting blind spots in Microsoft Defender’s CDP and provides actionable mitigation strategies for security teams operating in high-risk environments.
Microsoft Defender’s cloud-delivered protection relies on a combination of behavioral analytics, cloud-based sandboxing, and real-time telemetry from millions of endpoints. However, fileless malware has adapted by operating entirely within memory or leveraging trusted system components, thus avoiding the creation of disk-based artifacts that trigger Defender’s scanning pipelines.
These attacks exploit several blind spots:
First observed in Q3 2025, NimbleMoth is a PowerShell-based malware that leverages WMI event subscriptions to trigger in-memory payload execution upon system boot. It queries the Defender cloud API via the Get-MpComputerStatus cmdlet to confirm Defender is active and not running in a sandbox. Once validated, it uses WMI event filters tied to the Win32_ProcessStart class to launch a base64-encoded PowerShell script that injects shellcode into explorer.exe.
Evasion Technique: Uses legitimate WMI provider registration to persist across reboots without writing to disk.
Defender Blind Spot: WMI event triggers are not monitored by default in cloud-delivered protection due to performance constraints.
GhostHollow is a .NET-based reflective DLL that abuses the signed regsvr32.exe process to load malicious code from memory. It uses DNS tunneling over HTTPS to exfiltrate data and validates the target environment by checking the presence of MsMpEng.exe via WMI. If Defender is detected, it delays execution to avoid sandbox detonation.
Evasion Technique: Reflective loading avoids the need for a DLL on disk, and DNS traffic is encrypted and split across multiple domains.
Defender Blind Spot: Memory scanning of regsvr32 processes is disabled by default in enterprise profiles to reduce false positives.
AzurePhantom is a cloud-native fileless strain that abuses Azure AD–signed authentication tokens to move laterally within hybrid environments. It uses the Microsoft Graph API to enumerate users and groups, then forges tokens to access internal resources. The initial payload is delivered via a phishing link that triggers a PowerShell one-liner, which then queries the Defender API (https://api.security.microsoft.com) to confirm the endpoint is protected.
Evasion Technique: Uses legitimate Azure AD tokens to bypass Defender’s identity protection alerts.
Defender Blind Spot: Defender for Endpoint does not inspect Graph API traffic for malicious intent by default.
ConsentHijack targets the consent.exe process, which is used by Windows for UAC prompts. It leverages a signed Microsoft DLL (usercpl.dll) to inject shellcode that establishes a reverse shell. The malware checks the Defender version via WMI to ensure it is not running an outdated or sandboxed instance before executing.
Evasion Technique: Uses a Microsoft-signed binary to bypass code integrity checks and injects into a high-privilege process.
Defender Blind Spot: Memory scanning of consent.exe is often disabled due to its legitimate use in UAC prompts.
An evolution of the PowerSploit framework, PowerSploitX uses AMSI (Antimalware Scan Interface) bypass techniques to disable Defender’s real-time scanning during execution. It then loads a malicious PowerShell module entirely in memory, using DNS over HTTPS (DoH) for C2. To avoid detection, it queries the Defender cloud service to confirm the endpoint is not part of a sandbox or high-risk group.
Evasion Technique: Dynamically disables AMSI using memory patching, then executes payloads that are never written to disk.
Defender Blind Spot: AMSI bypasses are not logged in Defender for Endpoint unless cloud-delivered protection is explicitly configured to monitor AMSI events.
While Microsoft Defender for Endpoint is one of the most advanced EDR solutions, its cloud-delivered protection module has several architectural limitations that fileless malware exploits:
To reduce exposure to fileless malware strains exploiting Microsoft Defender’s blind spots, organizations should implement a multi-layered defense strategy: