A security operations center (SOC) detects a 'Process Hollowing' event where a legitimate system process, `svchost.exe`, was started in a suspended state. The memory image of the process was kemudian replaced with a malicious payload, and the thread was resumed. Since the malicious code now runs under the identity of a trusted system process and never existed as a distinct malicious file on the disk, it is a hallmark of fileless behavior. What is the primary benefit to the attacker when using this technique?