PEN-200 Antivirus Evasion Practice Test 2 — 15 Questions

Question 1

Which THREE techniques are commonly implemented in malware to detect and evade dynamic analysis within an automated sandbox environment?

Accepted Answer

Checking for a low number of CPU cores or small RAM size. Sandbox evasion relies on identifying traits that distinguish a virtualized, automated analysis environment from a real user workstation. Malware often checks for specific hardware configurations, waits for human-like interaction, or uses long delays to exceed the sandbox's limited analysis time. These methods ensure the malicious payload remains dormant while the environment is being monitored by security researchers.

Answer

Executing a large number of NOP instructions to increase file size

Answer

Using direct syscalls to bypass the Windows API hooks

Question 2

When evaluating an antivirus solution's effectiveness, what is the primary difference between signature-based detection and behavioral-based detection?

Accepted Answer

Signatures identify known files, while behavior identifies suspicious actions.. Signature-based detection is a reactive approach that relies on a database of known threats, while behavioral-based detection is a proactive approach that monitors for suspicious actions. Understanding this distinction is crucial for evasion, as bypassing one often requires different techniques than bypassing the other, such as obfuscating file content versus using legitimate system tools for malicious purposes.

Answer

Signatures look for file hashes, while behavior looks for network traffic.

Answer

Signatures are only used for disk scans, while behavior is for memory scans.

Answer

Behavioral detection is always more accurate and faster than signature-based.

Question 3

Which TWO methods are effective for obfuscating a PowerShell script to bypass AMSI without modifying the underlying system DLLs?

Accepted Answer

String Concatenation. PowerShell obfuscation for AMSI bypass focuses on making the script content unrecognizable to the scanner. String concatenation breaks up known malicious keywords, while variable randomization ensures that simple signature matches fail. These techniques are applied directly to the script code and do not require administrative privileges to patch memory or modify protected system files like amsi.dll.

Answer

Memory Patching

Answer

Registry Modification

Answer

Kernel Driver Loading

Question 4

A tester is targeting a Windows machine and notices that a specific legitimate application regularly looks for a COM object that is missing from the HKEY_CURRENT_USER (HKCU) registry hive, eventually falling back to HKEY_LOCAL_MACHINE (HKLM). How can this be exploited for evasion?

Accepted Answer

By hijacking the COM object to execute code under a trusted process.. This scenario describes COM Hijacking. By creating the missing registry key in HKCU, the attacker can redirect the application to load a malicious DLL. Since HKCU is searchable before HKLM and can be modified without administrative privileges, this allows for persistent execution of code within a trusted process while bypassing alerts that might trigger on more obvious persistence methods.

Answer

By performing a privilege escalation to modify the HKLM hive.

Answer

By using the missing key to trigger a buffer overflow in the application.

Answer

By deleting the HKLM key to force the application to use HKCU.

Question 5

Which THREE 'Living off the Land' (LotL) binaries are frequently used by penetration testers to download or execute malicious code while bypassing basic antivirus restrictions?

Accepted Answer

certutil.exe. Living off the Land binaries (LoLBins) are legitimate, pre-installed Windows tools that can be repurposed for malicious activities. Using these tools is effective for evasion because they are signed by Microsoft and are often whitelisted by security policies. Certutil, Mshta, and Regsvr32 are classic examples that can fetch remote files or execute scripts while appearing as normal system operations.

Answer

calc.exe

Answer

notepad.exe

Question 6

A penetration tester uses process hollowing to hide their payload inside 'svchost.exe'. They start the process in a suspended state, unmap its memory, write their shellcode, and resume the thread. What is a specific indicator that an advanced EDR might use to detect this activity?

Accepted Answer

The entry point of the process in memory differs from the image on disk.. Process hollowing is a powerful evasion technique, but it leaves behind traces in the system's memory and process metadata. Advanced EDR solutions monitor for discrepancies between the file on disk and the code in memory. They also track specific API call sequences, such as creating a process in a suspended state followed immediately by memory unmapping and cross-process writing.

Answer

The 'svchost.exe' process will show a significantly higher CPU usage.

Answer

The process will be unable to communicate with the network.

Answer

The system will automatically restart the process due to a checksum error.

Question 7

Why is using the default 'msfvenom' encoders like 'shikata_ga_nai' often insufficient for bypassing modern antivirus solutions?

Accepted Answer

The decoding stubs have well-known, static signatures.. Metasploit encoders were originally designed to remove 'bad characters' from shellcode to ensure it would run correctly in an exploit. They were not primarily intended for antivirus evasion. Because these encoders are open-source and widely used, antivirus vendors have had years to develop highly accurate signatures for the decoding stubs they generate, making them easily detectable.

Answer

They only work on 32-bit systems and are ignored by 64-bit AV.

Answer

The encoders increase the file size, making it look suspicious.

Answer

They use encryption that is easily decrypted by the AV engine.

Question 8

Refer to the exhibit.

[!] Error compiling payload: Function 'VirtualAlloc' not found in target assembly scope.

An operator is writing a custom process injection loader in C# and encounters the compilation error shown above while attempting to allocate memory for shellcode. How should the operator properly resolve this issue to enable low-level memory allocation?

Accepted Answer

Import the unmanaged function from kernel32.dll using Platform Invoke (P/Invoke) declarations.. Managed languages like C# do not natively expose low-level Windows API functions like VirtualAlloc without explicit interoperability declarations. Utilizing Platform Invoke allows developers to import unmanaged DLL functions from kernel32.dll, bridging the gap between managed code execution and low-level memory manipulation required for advanced payload execution.

Answer

Replace VirtualAlloc with the standard .NET File.ReadAllBytes method to read the shellcode into a byte array.

Answer

Enable unsafe code blocks in the project settings and use raw C-style pointer arithmetic directly.

Answer

Compile the C# application as a 64-bit exclusive binary to match the target operating system architecture.

Question 9

When analyzing the memory of a compromised system, you find that your shellcode is being detected by behavioral monitoring. What is the most effective approach to reduce the likelihood of detection by EDR systems during process injection?

Accepted Answer

Utilizing indirect syscalls to execute memory operations without triggering API hooks.. Behavioral detection focuses on suspicious API calls, such as VirtualAllocEx and WriteProcessMemory, being called by an unauthorized or unexpected process. By using indirect syscalls or alternative memory allocation methods, you can bypass the hooks that security products place on high-level Windows APIs. This is critical in modern testing because EDRs monitor process interactions in real-time, making standard injection techniques trivial for security software to identify and block immediately.

Answer

Increasing the sleep interval between shellcode execution stages.

Answer

Injecting the shellcode into a low-privilege process to minimize impact.

Answer

Replacing the shellcode with an equivalent set of PowerShell commands.

Question 10

An ethical hacker wants to evade signature-based detection while developing a custom reverse shell loader for a PEN-200 lab assignment. Which technique fundamentally alters the binary's byte signatures without modifying its core execution logic or breaking the payload?

Accepted Answer

Applying XOR encoding to the payload buffer and implementing a custom runtime stub to decrypt it in memory.. Encoding or encrypting the payload alters static byte signatures that antivirus engines use to flag known malicious files. By decoding the payload dynamically in memory at runtime, the payload remains obfuscated on disk, preventing signature detection while preserving the exact execution logic required for the reverse shell to successfully connect back to the attacking machine.

Answer

Stripping all debugging symbols and symbol tables from the executable using strip.

Answer

Modifying the file extension from .exe to .scr to trick the operating system shell.

Answer

Compressing the final executable binary using standard ZIP archiving utilities without a password.

Question 11

When evaluating antivirus evasion techniques for Windows targets in a penetration test, which TWO of the following approaches specifically target memory-based detection mechanisms rather than static disk signatures? (Choose TWO)

Accepted Answer

Direct system calls invoked via assembly instructions to bypass user-mode hooks placed by security software in ntdll.dll.. Memory-based evasion techniques focus on how payloads behave in RAM and interact with operating system APIs. Syscall manipulation avoids hooked functions in ntdll.dll, while process injection executes code within legitimate, trusted processes to blend in with normal system activity and avoid heuristic flags.

Answer

Applying a multi-layer XOR encoder to obfuscate the binary payload before writing the executable to the target hard drive.

Answer

Modifying the compilation timestamp within the portable executable header to confuse static signature heuristics.

Answer

Compressing the compiled binary with UPX to scramble sections and alter the import address table layout.

Question 12

An operator is analyzing why a compiled C# stager payload was flagged immediately by Windows Defender despite having a completely unique cryptographic hash. Which AV detection mechanism is most likely responsible for flagging the binary based on internal structure rather than known file signatures?

Accepted Answer

Heuristic analysis evaluating suspicious API imports, section characteristics, and code patterns indicative of stagers.. Heuristic and behavioral engines examine internal characteristics, structural layouts, and API import patterns rather than relying strictly on known file hashes. If a binary imports suspicious combinations of memory allocation and execution APIs, heuristics flag it as malicious even if the file has never been seen before.

Answer

Cloud-based cryptographic hash lookup databases containing global blacklists of known malware samples.

Answer

Static signature matching using rigid byte sequences extracted from older malware variants.

Answer

Network signature inspection monitoring incoming HTTP traffic headers for default command and control strings.

Question 13

Refer to the exhibit. An examiner attempts to use raw msfvenom output directly in a custom C template for a PEN-200 lab assignment, but the payload is instantly detected. Why is generating raw msfvenom output generally ineffective for antivirus evasion without further modification?

Accepted Answer

Default msfvenom payloads contain heavily signatured stager stubs and byte patterns that are universally fingerprinted by security products.. Default msfvenom templates and encoders contain heavily signatured instruction patterns and well-known strings that antivirus vendors have fingerprinted extensively over many years. Without custom encoding, manual structural modifications, or custom loader implementation, raw framework outputs are immediately flagged by signature scanners.

Answer

The C array output format automatically introduces formatting syntax errors that cause the compiler to generate invalid portable executable headers.

Answer

Using HTTPS as the communication protocol forces the stager to include unencrypted TLS certificates that antivirus software automatically blocks.

Answer

The 64-bit architecture flag conflicts with standard Windows Defender file scanning routines, triggering an immediate administrative alert.

Question 14

During a PEN-200 lab, a penetration tester develops a custom C# loader that allocates memory, writes shellcode, and executes it. Windows Defender's AMSI flags the process when the shellcode buffer is passed to a scanning routine. The tester wants to prevent AMSI from inspecting the buffer at runtime without disabling Defender. Which technique should the tester apply?

Accepted Answer

Use the AmsiScanBuffer function's memory patching to force it to return a clean result.. AMSI scans buffers passed to functions like AmsiScanBuffer; to evade it without disabling Defender, the tester can patch AmsiScanBuffer in memory to return a benign result. This prevents the shellcode from being flagged. Encoding, CFG, or user privileges do not stop AMSI from scanning the buffer at runtime.

Answer

Run the loader under a different user account with limited privileges.

Answer

Base64-encode the shellcode and decode it at runtime before execution.

Answer

Compile the loader with the /guard:cf flag to enable Control Flow Guard.

Question 15

A penetration tester has obtained a low-privilege shell on a Windows 10 host protected by Windows Defender with real-time protection enabled. The tester wants to execute a custom .NET assembly in memory to avoid writing a payload to disk, but Defender's AMSI integration repeatedly flags the assembly when loaded via the standard reflection technique. Which modification to the in-memory loading approach is MOST likely to prevent AMSI from inspecting the assembly's content?

Accepted Answer

Patch the AmsiScanBuffer function in amsi.dll in the current process before loading the assembly.. AMSI integrates with the .NET runtime and submits assembly content to AmsiScanBuffer before execution. Patching that function in the current process causes the scan to return a benign result, allowing the in-memory assembly to load without Defender receiving the buffer. Encryption, encoding, and remote loading do not prevent the runtime from passing the decrypted or fetched bytes to AMSI, so they fail against runtime inspection even though they may help against static file signatures.

Answer

Base64-encode the assembly bytes and load them with Assembly.LoadFrom after decoding.

Answer

Store the assembly on a remote SMB share and load it with Assembly.LoadFrom over the network path.

Answer

Encrypt the assembly with AES and decrypt it directly into a memory region allocated with PAGE_EXECUTE_READWRITE.