In 2017, over half of all malware was file-less malware. As cyber threat adversaries evolve, so do their methods. Today, file-less malware is more prevalent in organization's environment than file-based malware because file-based malware can be detected and blocked with current security controls due to the fact that file-based malware is detectable via artifacts known as Indicators Of Compromise. To resolve this dilemma, cyber threat adversaries had to find a way to complete their malicious operations without being detected by current controls. Since file-less malware leaves almost no artifacts, there can be no threat detection or threat hunt using Indicators Of Compromise because no IOCs exist. Instead, Tactics, Techniques and Procedures (TTPs) that cyber threat adversaries use are the way to detect modern attack scenarios.