Threat Detection Engineering: Building Detection Rules That Matter

Fileless malware is one of the most dangerous and evasive attack techniques. Unlike traditional malware, it leaves no files on disk; instead, it hides inside the system's own trusted processes and tools, making it nearly invisible to conventional security software. In this article, we break down how fileless and process-based attacks work, how attackers use built-in Windows utilities like PowerShell and WMI to execute malicious code entirely in memory, and what defenders need to do to detect and stop them before it's too late.

In mid-September 2025, Anthropic's Threat Intelligence team detected and disrupted a cyber espionage campaign attributed with high confidence to a Chinese state-sponsored group designated GTG-1002. It's considered the first documented AI-orchestrated cyberattack at this scale (Involving all phases of a cyber kill chain majorly done by AI). The attackers manipulated Claude Code into acting as an autonomous attack agent by social engineering it. They built a framework using Claude Code and Model Context Protocol (MCP) tools to run the attack largely without human involvement. The AI handled 80–90% of all tactical operations, including reconnaissance, vulnerability discovery, exploitation, credential harvesting, lateral movement, and data exfiltration. Human operators only stepped in at strategic decision points like approving escalation to active exploitation or authorizing final data exfiltration.

MITRE ATT&CK v19.1 introduces significant updates across the Enterprise, Mobile, and ICS domains, enhancing the framework’s ability to model modern adversary behavior. Key changes include the introduction of the new Defense Impairment tactic, the renaming of Defense Evasion to Stealth, expanded threat intelligence coverage with new threat groups, software, and campaigns, and the addition of ICS sub-techniques for greater analytical granularity. This article explores the major differences between ATT&CK v18.1 and v19.1, highlighting the impact of these changes on threat intelligence, detection engineering, and cybersecurity operations.