Hi Javier,
regards to detecting malware, there are two ways Network layer and Endpoint layer in Netwitness suite of products. For actual identification of any malware executable which is fileless in nature can be identified by RSA netwitness endpoint. The comparison of disk and memory provides the necessary detection capabilities to conclude on such detonations on endpoints. Also, our endpoint provides the network connection visibility in addition to threat intel feeds and IIOCs for further analysis and forensics on such executables.
in nutshell, you will not be able to detect and conclude fileless malware at packet or log layer without the actual netwitness endpoint. This is a complete story and all threads need to be matched.
