MemLOL: Memory-Based LOLBins Dataset for Fileless Malware Detection

Fileless malware has emerged as a prominent cyber threat that does malicious activities in memory to evade traditional detection methods. Fileless malware leaves very minimal forensic traces on disk. These attacks leverage LOLBins (Living Off the Land Binaries), legitimate system tools such as wscript.exe, dllhost, and powershell, wmic, etc, to perform the malicious operations, hence escape detection techniques. Fileless malware leads the threat rogue along deep fakes and ransomwares. Advanced detection techniques tailored to detect such sophisticated attack vectors are mandatory. Despite the growing threat, research in fileless malware detection lags due to the lack of publicly available datasets. The proposed work addresses this critical gap, leveraging real-time fileless malware samples. With the available samples, the work enhances the dataset focusing on LOLbins such as dllhost, wscript.exe, etc. A hybrid approach integrating dynamic behaviour and memory forensic artifacts, is the base of this work. It aims to create a dataset that reflects the evolving manoeuvres of fileless malware. With improved accuracy and generalizability, the dataset would be a vital resource for machine learning models and also for the cybersecurity research community. The proposed dataset includes 75 fileless malware samples and 47 benign samples, combined with the existing dataset resulted in a total of 161 samples.