A typical tactic is to steal credentials to carry out a fileless attack. Stolen credentials can be used to attack a device under the guise of a legitimate user. Hackers can persistently conceal code in the registry or kernel or establish user identities that access the chosen machine.
Using stolen credentials, attackers get hold of a device, allowing them to use native tools such as WMI or PowerShell to perform the attack. Most cybercriminals also create user accounts to gain access to any system.