Certified Ethical Hacker (CEH) Practice Question

The macro relies on the host's built-in PowerShell interpreter to fetch and execute shellcode entirely in RAM. Because the payload never touches the file system, traditional file-based scanners have little to scan, making detection difficult. This is the hallmark of fileless malware that operates through in-memory execution. Polymorphic malware focuses on code mutation to evade signature scanners, multipartite viruses infect both boot sectors and files, and kernel-level rootkits hide by hooking low-level functions-none of which necessarily avoid writing files to disk as in this scenario.