A cybersecurity research proposal exploring a practical approach to detecting and neutralizing fileless malware using Sysmon, PowerShell Logging, and Memory Forensics in educational institution network environments.
Author: Moises Ceazar C. Del Mundo
Program: Bachelor of Science in Information Technology
Section: IT3A
Institution: De La Salle Lipa
Department: Information Technology Department
Adviser: Rodante S. Chavez
Date: September 2025
Research Status: Research Proposal
Fileless malware is a type of cyberattack that operates primarily in system memory or abuses legitimate system tools such as PowerShell and Windows Management Instrumentation (WMI). Because these attacks may leave little or no malicious files on disk, they can be difficult for traditional signature-based antivirus solutions to detect.
This research proposal presents a practical detection and neutralization approach designed for educational institution network environments. The proposed approach combines:
- Sysmon for detailed system and process monitoring
- PowerShell Logging for tracking script and command-line activity
- Memory Forensics for examining volatile memory and identifying hidden malicious activity
The study focuses on improving visibility into script-based and in-memory attacks and supporting IT administrators in identifying, analyzing, and neutralizing suspicious activity.
To develop a practical method for detecting and neutralizing fileless malware in educational institutions' network environments by using Sysmon, PowerShell Logging, and Memory Forensics to improve visibility, detection, and response against stealthy threats.
- Use Sysmon and PowerShell Logging to address the limitations of traditional antivirus in detecting fileless malware.
- Create a detection approach tailored for educational institutions that improves visibility into script-based and in-memory attacks.
- Apply memory forensics to uncover hidden malicious code in volatile memory and support effective incident response.
The research addresses the lack of effective methods for detecting and neutralizing fileless malware in educational institutions.
Key problems include:
- Traditional antivirus may have difficulty detecting fileless malware because malicious activity can occur without a conventional malicious file stored on disk.
- Educational institutions may lack specialized detection methods for script-based and in-memory attacks.
- Limited visibility into memory activity can make it difficult to uncover hidden malicious code and respond effectively.
┌──────────────────────┐
│ Suspicious Activity │
│ / PowerShell Input │
└──────────┬───────────┘
│
┌──────────────┼──────────────┐
▼ ▼ ▼
┌────────────┐ ┌──────────────┐ ┌───────────────┐
│ Sysmon │ │ PowerShell │ │ Memory │
│ Monitoring │ │ Logging │ │ Forensics │
└─────┬──────┘ └──────┬───────┘ └───────┬───────┘
│ │ │
└───────────────┼─────────────────┘
▼
┌──────────────────────┐
│ Correlation & │
│ Security Analysis │
└──────────┬───────────┘
▼
┌──────────────────────┐
│ Detection & Threat │
│ Confirmation │
└──────────┬───────────┘
▼
┌──────────────────────┐
│ Neutralization │
│ & Risk Mitigation │
└──────────────────────┘
The proposal describes correlating Sysmon and PowerShell logs with memory-forensic findings to identify patterns associated with malicious behavior.
The research follows an Input–Process–Output (IPO) framework.
The user, acting as an IT administrator or researcher, executes both normal and malicious PowerShell commands to simulate fileless malware activity. These activities generate system and network events.
- Sysmon Monitoring — monitors system activity and records process creation, command-line execution, and network activity.
- PowerShell Logging — tracks executed commands and script activity, including suspicious or potentially harmful scripts.
- Memory Forensics — extracts and examines volatile memory to uncover hidden malicious code or suspicious in-memory processes.
- Correlation and Analysis — compares Sysmon and PowerShell logs with memory-forensic findings to identify patterns of malicious behavior.
The proposed process produces security logs and detection results that provide actionable insights, support anomaly detection, and assist IT administrators in implementing timely neutralization strategies.
The proposed architecture consists of a Windows user workstation, Sysmon, PowerShell Logging, a separate memory-forensics analysis environment, the educational network, and an IT administrator responsible for reviewing correlated evidence.
┌───────────────────────┐
│ Windows Workstation │
│ PowerShell Activity │
└───────────┬───────────┘
│
┌──────┴───────┐
▼ ▼
┌──────────┐ ┌──────────────────┐
│ Sysmon │ │ PowerShell │
│ Event │ │ Logging / │
│ Capture │ │ Transcription │
└─────┬────┘ └────────┬─────────┘
│ │
└───────┬────────┘
▼
┌──────────────────┐
│ Educational │
│ Network │
└────────┬─────────┘
▼
┌──────────────────┐
│ Analysis & │
│ Detection │
│ Reviewed by IT │
│ Administrator │
└────────┬─────────┘
▼
┌──────────────────┐
│ Threat │
│ Neutralization │
│ & Secure Network │
└──────────────────┘
Separate Analysis Path
│
▼
┌──────────────────┐
│ Memory Forensics │
│ Tool / RAM │
│ Analysis │
└──────────────────┘
| Technology / Concept | Role in the Research |
|---|---|
| Sysmon | Captures process creation, network connections, and system activity. |
| PowerShell Logging | Records PowerShell script and command-line activity. |
| PowerShell Script Block Logging | Provides visibility into executed PowerShell script content. |
| Memory Forensics | Examines volatile memory for hidden or active malicious activity. |
| Windows | Target operating system for the proposed environment. |
| Fileless Malware | Primary threat investigated by the study. |
| Incident Response | Supports analysis, containment, and neutralization activities. |
| Behavioral Analysis | Helps identify suspicious activity beyond file-based signatures. |
The study focuses on detecting and neutralizing fileless malware within educational institution network environments in Batangas province.
The proposed approach applies:
- Sysmon for system monitoring
- PowerShell Logging for script tracking
- Memory Forensics for volatile-memory analysis
IT administrators and staff are intended to test the proposed methods within a simulated institutional network during Academic Year 2025–2026.
The research is limited to:
- Windows-based environments
- Detection and neutralization of fileless malware
- Simulated educational institution network environments
- Educational institutions within Batangas province
The study does not focus on:
- Developing antivirus software
- Creating a full-scale malware remediation framework
- Non-Windows operating systems
- All possible real-world institutional network conditions
External factors such as internet connectivity, hardware limitations, and institutional policies are outside the study's control.
1. Execute Normal / Malicious PowerShell Activity
↓
2. Generate System & Network Events
↓
3. Collect Sysmon Events
↓
4. Collect PowerShell Logs
↓
5. Capture / Analyze Volatile Memory
↓
6. Correlate Evidence
↓
7. Identify Suspicious Patterns
↓
8. Confirm Fileless Malware Activity
↓
9. Apply Appropriate Neutralization
This workflow is proposed as the basis for evaluating the ability of the combined approach to improve detection and response.
Provides detailed endpoint telemetry related to processes, command lines, and network connections.
Provides visibility into PowerShell commands and scripts that could otherwise be difficult to investigate.
Provides a method for examining volatile memory to identify malicious code or processes that may not be visible through conventional file-based analysis.
Combining the three sources provides a broader evidence base for identifying suspicious behavior and supporting incident response.
Gain practical tools for detecting and responding to fileless malware beyond the limitations of traditional antivirus.
Benefit from stronger protection against data breaches, unauthorized access, and service disruption.
Help protect student records, academic files, and research outputs.
Support protection of teaching resources, academic materials, and research work.
Provide a reference for future work involving fileless malware detection and digital forensics.
The proposal reviews research related to:
- Fileless malware detection
- Behavioral analysis
- Memory forensics
- PowerShell-based attacks
- Malware detection
- Cybersecurity in Philippine academic institutions
The reviewed literature supports the proposed use of memory forensics and PowerShell monitoring as complementary approaches to traditional malware detection.
Current Status: Research Proposal
This repository represents the research proposal and proposed methodology. It should not be interpreted as evidence that a complete production detection and neutralization system has already been implemented or deployed.
Future implementation work may include:
- Building the Windows test environment
- Configuring Sysmon
- Enabling and collecting PowerShell logs
- Conducting controlled fileless-malware simulations
- Capturing memory images
- Performing memory-forensic analysis
- Correlating endpoint evidence
- Evaluating detection effectiveness
- Documenting neutralization procedures
Any malware simulation associated with this research should be conducted only in an isolated and controlled laboratory environment.
Testing should avoid:
- Production systems
- Uncontrolled networks
- Real organizational endpoints
- Unauthorized malware execution
- Exposure of sensitive institutional information
The purpose of the research is defensive: to improve detection, analysis, containment, and neutralization of fileless malware.
Fileless-Malware-Detection-and-Memory-Forensics/
│
├── README.md
│
├── research/
│ └── Research-Proposal.pdf
│
├── architecture/
│ ├── operational-architecture.png
│ └── technical-architecture.png
│
├── detection/
│ └── ...
│
├── memory-forensics/
│ └── ...
│
└── documentation/
└── ...
The
detection/andmemory-forensics/directories can be added later if the proposed methodology is implemented and experimentally validated.
- Aquino, M. F. M., & Noroña, M. I. (2021). Enhancing cyber security in the Philippine academe: A risk-based IT project assessment approach.
- Sherazi, S. S. N. A., & Amna, Q. (2025). Hybrid analysis model for detecting fileless malware. Electronics, 14(15), 3134.
- Varlioglu, S. (2025). Detecting PowerShell-based fileless cryptojacking attacks using machine learning. Izmir Institute of Technology.
- Zhang, S., Hu, C., Wang, L., Mihaljevic, M. J., Xu, S., & Lan, T. (2023). A malware detection approach based on deep learning and memory forensics. Symmetry, 15(3), 758.
Moises Ceazar C. Del Mundo
Bachelor of Science in Information Technology
Major in Information Security
De La Salle Lipa
Research Adviser: Rodante S. Chavez
Disclaimer: This project is based on a cybersecurity research proposal developed for academic purposes. The proposed techniques should only be implemented and tested in authorized, isolated environments.