Researchers Observe Fileless Malware Attacks Using Shellcode Hidden in Windows Event Logs

The dropper modules also patch Windows native API functions, related to event tracing (ETW) and anti-malware scan interface (AMSI), to make the infection process stealthier.