DB.
Courses

Antivirus Evasion
OSCP · Chapter 11

Antivirus Evasion

Antivirus and EDR evasion is about making a payload behave differently to defensive tooling than it does when actually executed — obfuscation, encoding, and living-off-the-land techniques that use trusted OS binaries instead of dropping new malware files.

Key concepts

  • Signature-based AV looks for known byte patterns — simple re-encoding or packing a payload can already dodge naive signatures (bypassing is not the same as being undetectable to modern EDR).
  • "Living off the land" (LOLBins) uses built-in trusted binaries (PowerShell, certutil, rundll32) to execute or download payloads, blending in with normal admin activity.
  • Modern EDR watches behavior, not just static signatures — process injection, unusual parent/child process trees, and command-line obfuscation are all detection triggers on their own.
  • This is purely a defensive-research skill during authorized engagements: the goal is to demonstrate detection gaps to the blue team, not to actually evade production security controls without authorization.

Try it yourself

In an isolated lab VM with Windows Defender enabled, review the MITRE ATT&CK "Command and Scripting Interpreter" technique and identify three built-in Windows binaries that could be abused as LOLBins, and what a defender would look for to catch each one.

ReferenceSearch video walkthroughs

@ Daniel Burlacu