Most Intrusions No Longer Involve Malware

The sentence that best describes the last few years of intrusion detection is not about artificial intelligence. It is about absence. CrowdStrike's measurement of its own telemetry found that 79% of detections in 2024 and 82% in 2025 involved no malware at all: no executable to quarantine, no file hash to block, nothing for a signature engine to match. The attacker logged in.

This is not a new idea, but it has crossed a threshold. When the majority of intrusions are malware-free, an estate whose detection strategy is built around files is measuring the wrong thing, and a response plan built around re-imaging endpoints is solving the wrong problem.

What Malware-Free Looks Like

The techniques are ordinary administration, which is exactly why they work:

• Valid accounts. Credentials bought from infostealer logs, reused from an old breach, or phished through a proxy that relays the session and its token.
• Living off the land. PowerShell, WMI, PsExec, rundll32 and scheduled tasks used for discovery, lateral movement and persistence. Every one of them is a legitimate tool with a legitimate administrative purpose.
• Cloud control planes. An identity with a role, used through the provider's API, leaving audit logs rather than process trees. There is no host to inspect and often no endpoint in the path at all.
• Trusted software abused. Remote monitoring agents, backup software and helpdesk tools that are supposed to have remote control, deployed by an attacker who has the credentials to enrol a new agent.

The economics explain the shift. A phishing kit that relays a session costs less than a working exploit chain, does not depend on an unpatched vulnerability, and survives most of the controls that endpoint security added over the past decade. Stealer logs are cheap because they are abundant, and an infostealer that runs for ninety seconds and exfiltrates browser cookies has done its job before any behavioural rule has enough evidence to act.

Why the Endpoint Is Necessary but Not Sufficient

Endpoint detection and response remains the best telemetry available on a host, and the convergence of EDR and extended detection into a single platform has genuinely improved correlation. But the signal it produces is about processes, and the intrusion is increasingly about identity. A login from a new location using a valid session token looks like a legitimate employee working from a hotel. A new OAuth grant looks like an integration. A mailbox rule that forwards finance mail looks like a user organising their inbox.

What catches these events is not a better file scanner. It is a model of what the identity normally does: which devices it uses, which applications it consents to, which countries it signs in from, which mailbox rules it creates, and how quickly those patterns change. Behavioural detection was always the theory; the data to do it well now sits in identity providers and SaaS audit logs rather than only on endpoints.

Identity Threat Detection and Response

ITDR is the clumsy name for the discipline that fills the gap. In practice it means monitoring the identity provider as a security sensor, not just as an authentication service:

• Sign-ins from new devices and impossible travel, with context about the application being accessed.
• Token issuance and refresh anomalies, including session reuse from a different network.
• MFA changes: a new method added, an old one removed, a number changed.
• Consent grants, especially those requesting mail, file or directory access.
• Privilege changes and new device enrolments, which are how persistence is often made durable.

None of these events is malicious on its own, and that is the point. The detection is a sequence: a token issued from an unusual location, followed by a mailbox rule, followed by a consent grant. Each step is individually unremarkable and collectively a story.

The Response Is Also Different

Re-imaging an endpoint does not evict an attacker who never installed anything. The response playbook for a credential-based intrusion has its own checklist: revoke refresh tokens and active sessions rather than only resetting the password, because a stolen token survives a password change; remove mailbox forwarding rules and delegate access; revoke OAuth grants the user did not create; check for new device enrolments and new authentication methods; and search identity logs for the same session appearing elsewhere. Only then is it worth asking whether a host was touched at all.

The correction to make is not to abandon signature detection. Commodity malware still arrives in volume, ransomware still ships binaries, and antivirus still catches the things that were never targeted at you. The correction is to stop treating the absence of a file as the absence of a compromise. Backups with object lock and tested restores remain essential, for the same reason the extortion economy has moved toward data theft: the loss you are insuring against is increasingly confidentiality, and no endpoint agent can restore that.