PEN-200 Antivirus Evasion Practice Test 3 — 15 Questions

Question 1

During a PEN-200 lab engagement, a tester delivers a custom C# implant compiled with csc.exe. Windows Defender's real-time protection immediately quarantines the executable at rest on disk, before any process is created. The tester wants to keep the same implant logic but reduce static file-based detection. Which approach best addresses this specific detection stage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pack the executable with a custom crypter that XOR-encrypts the payload bytes and decrypts them only in memory at runtime.. Detection at rest is driven by static signatures over the file's bytes and PE structure. Changing the stored representation so the original signature no longer matches, while reconstructing the functional payload only in memory, directly defeats that stage. Renaming, self-signing, and archiving leave the underlying executable bytes unchanged, so the same on-disk signature continues to match once the file is written or extracted.

Answer

Rename the executable to a trusted Windows binary name such as svchost.exe and place it in C:\Windows\System32.

Answer

Compress the executable into a password-protected ZIP archive and deliver the archive to the target host.

Answer

Sign the executable with a self-signed code-signing certificate generated with makecert.exe.

Question 2

During an authorized penetration test, a tester needs to deliver a Meterpreter payload to a Windows Server 2019 target that runs a next-generation antivirus with behavioral monitoring. The tester decides to use a process injection technique to run the payload inside a legitimate process. Which injection method is LEAST likely to be flagged by behavioral monitoring because it avoids allocating new executable memory in the target process?

Accepted Answer

Module stomping by overwriting the .text section of a loaded DLL with shellcode.. Module stomping avoids allocating new executable memory by reusing the existing .text section of a loaded DLL. Since the memory is already executable and associated with a legitimate module, it bypasses detection logic that looks for new PAGE_EXECUTE_READWRITE allocations or suspicious thread creation. Other injection methods require allocating or modifying executable memory in ways that behavioral monitoring commonly correlates with malicious activity, making them more likely to be flagged.

Answer

Process hollowing by creating a suspended process and replacing its image.

Answer

Thread execution hijacking by suspending a thread and modifying its context to point to shellcode.

Answer

Classic CreateRemoteThread with VirtualAllocEx and WriteProcessMemory.

Question 3

A penetration tester has a working unmanaged PowerShell runner in C# that executes a script block on a Windows 10 host with AMSI enabled. The runner currently fails because AMSI scans the script content. The tester wants to disable AMSI scanning for the current process without touching files on disk and without requiring administrative privileges. Which technique best fits these constraints?

Accepted Answer

Patch the AmsiScanBuffer function in memory by overwriting its first bytes with a return value that indicates a clean scan.. AMSI performs in-process scanning through functions resolved from amsi.dll, most notably AmsiScanBuffer. Because the DLL is loaded into the calling process, a user-mode patch of that function in memory changes scan results for that process only, needs no administrative rights, and writes nothing to disk. Deleting system files, inventing registry policies, or adjusting execution policy do not alter the in-memory scanning path AMSI uses.

Answer

Set the registry value HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableAMSI to 1.

Answer

Run the PowerShell runner from a session launched with the -NoProfile and -ExecutionPolicy Bypass switches.

Answer

Delete the amsi.dll file from C:\Windows\System32 and reboot the target host.

Question 4

A junior penetration tester is preparing a payload for a Windows 10 target with Windows Defender enabled. The tester wants to avoid writing the payload to disk and decides to use a PowerShell one-liner that downloads and executes a script in memory. Which PowerShell feature allows the script to be executed directly from a downloaded string without saving it to a file?

Accepted Answer

Invoke-Expression (IEX) with a downloaded string.. Invoke-Expression takes a string and runs it as PowerShell code. By pairing it with a download cradle, the tester can retrieve a script into memory and execute it without touching disk. This is a standard in-memory execution technique for PowerShell. The other cmdlets either do not execute arbitrary PowerShell code, require local files, or are intended for different purposes such as loading .NET types or modules, so they do not fulfill the requirement.

Answer

Add-Type with a downloaded assembly.

Answer

Start-Process with the -FilePath parameter pointing to a URL.

Answer

Import-Module with a URL to a .psm1 file.

Question 5

A tester is preparing a reverse shell executable for a Windows target protected by a signature-based antivirus product. To reduce the chance the file is flagged, the tester wants to modify the binary so it no longer matches known signatures while keeping its behavior. Which action best accomplishes this?

Accepted Answer

Recompile the source after renaming functions and adding benign junk instructions, then rebuild the binary.. Signature-based detection compares file bytes against known patterns derived from code, strings, and embedded payloads. Altering the source so the compiled binary's byte sequence changes, such as renaming functions and inserting junk instructions, breaks that match while preserving functionality. Metadata edits, directory changes, and privilege elevation leave the underlying bytes intact, so the original signature continues to identify the file.

Answer

Run the executable with administrator privileges so it can bypass user-level scanning hooks.

Answer

Move the executable from the Downloads folder to a less commonly scanned directory such as C:\Temp.

Answer

Change the file's icon and version information resource to mimic a legitimate application.

Question 6

A penetration tester delivers a custom .NET executable to a Windows 10 host running Microsoft Defender with cloud-delivered protection enabled. The binary contains an embedded shellcode blob in its .data section. After the loader decrypts the shellcode in memory and begins executing it, Defender terminates the process even though the file itself never touched disk again. Which technique would most directly address this specific detection?

Accepted Answer

Change the shellcode's allocation from VirtualAlloc with PAGE_EXECUTE_READWRITE to VirtualAlloc with PAGE_READWRITE, then use VirtualProtect to flip the page to PAGE_EXECUTE_READ just before invoking the shellcode.. The detection is behavioral and memory-resident, so the fix must change how memory is allocated and protected. Marking a single region both writable and executable is a classic high-signal indicator that Defender's behavioral engine correlates with shellcode loaders. Allocating writable, writing the payload, and then re-protecting the page as executable removes that indicator while still allowing the shellcode to run. Encoding, compiler flags, and static obfuscation do not affect the in-memory execution profile.

Answer

Base64-encode the shellcode and decode it immediately before calling CreateThread.

Answer

Encrypt the shellcode with XOR and decrypt it at runtime using a stack-based routine.

Answer

Recompile the loader with the /GS- flag to disable stack cookies and reduce the binary's static footprint.

Question 7

You are tasked with delivering a Meterpreter payload to a Windows Server 2019 target protected by a next-generation antivirus that performs userland API hooking on NtAllocateVirtualMemory and NtProtectVirtualMemory. Your current C loader uses these APIs directly and is detected. Which technique is most appropriate to bypass the userland hooks without requiring kernel-level privileges?

Accepted Answer

Direct system calls by manually constructing the syscall stub and invoking the syscall instruction.. Direct system calls bypass userland API hooks because the hooks are placed in ntdll's exported functions, and invoking the syscall instruction directly skips that code. The other options either require kernel privileges, still transit the hooked APIs, or only address static detection rather than the behavioral hooks causing the detection.

Answer

Install a kernel-mode driver to remove the hooks from ntdll and restore original bytes.

Answer

Encrypt the payload with AES and decrypt it in memory just before execution.

Answer

Use PowerShell's Add-Type to compile the loader in memory, relying on the .NET runtime to bypass native hooks.

Question 8

A penetration tester is preparing a Windows payload for a client engagement where the target endpoint runs a traditional signature-based antivirus product that does not perform cloud lookups. The tester wants to reduce the chance that the raw output of msfvenom is flagged during initial delivery. Which action best addresses this goal?

Accepted Answer

Compile a custom loader that embeds the shellcode in an encrypted form and decrypts it at runtime, rather than delivering the raw msfvenom executable.. Signature-based antivirus matches known byte patterns in files. To avoid that match, the delivered artifact must not contain those known patterns. Building a custom loader that stores shellcode in encrypted form produces a file whose bytes differ entirely from the raw msfvenom output, so the original signature no longer applies. Compression and renaming leave the executable bytes intact, and well-known encoders like shikata_ga_nai are themselves signatured.

Answer

Rename the payload file to a benign-looking name such as invoice.pdf.exe and set the archive attribute.

Answer

Use msfvenom's -e encoder option with shikata_ga_nai and iterate the encoding multiple times.

Answer

Pipe the msfvenom output through gzip and deliver the compressed archive to the target.

Question 9

A penetration tester is preparing to bypass antivirus on a Windows target during a PEN-200 lab. The tester wants to use packing and encryption to alter the payload's signature and avoid static detection. Which TWO techniques are effective for evading static signature-based detection by changing the file's binary appearance without altering its functionality? (Choose two.)

Accepted Answer

Encrypting the payload with a unique key and including the decryption routine in a custom loader.. Effective static evasion requires changing the bytes that signatures match. Packers encrypt and compress the original code, so the on-disk file no longer contains the recognizable pattern. Encrypting the payload with a unique key and a custom loader achieves the same by making each build's bytes unique. Both preserve functionality while altering the binary appearance. Appending random bytes, renaming, or modifying PE metadata do not change the core code sections that signatures target, so they are ineffective for evading static detection.

Answer

Modifying the PE header to change the compile timestamp and checksum.

Answer

Renaming the executable file to a system process name such as svchost.exe.

Answer

Appending random bytes to the end of the executable to change its file hash.

Question 10

A penetration tester is building a custom shellcode runner in C for a PEN-200 lab. The compiled loader is being flagged by static analysis before execution. The tester wants to modify the loader's source so the resulting binary is less likely to match signatures, without changing the shellcode's behavior. Which two changes best serve this goal? (Choose two.)

Accepted Answer

Encrypt the embedded shellcode with a simple XOR key and decrypt it in memory before execution.. Static analysis of the loader is driven by recognizable shellcode bytes and a suspicious import table. XOR-encrypting the shellcode removes its signature-matching bytes from disk, and resolving APIs dynamically with LoadLibrary and GetProcAddress removes telltale imports like VirtualAlloc and VirtualProtect. Optimization, static runtime linking, and padding change size or dependencies but leave the shellcode bytes and imported APIs that triggered detection in place.

Answer

Statically link the C runtime library so the loader has fewer external dependencies.

Answer

Add a large embedded PNG image resource to increase the binary's file size.

Answer

Compile the loader with the /O2 optimization flag to reduce the binary's overall size.

Question 11

During a red team engagement, a tester writes a C# loader that calls the Win32 API function VirtualAllocEx to allocate memory in a remote process, writes shellcode, and creates a remote thread. The loader compiles and runs, but the endpoint's EDR blocks it before the remote thread executes. The tester confirms the EDR is hooking user-mode API functions in ntdll.dll. Which approach most directly avoids the user-mode hooks that triggered the block?

Accepted Answer

Implement direct system calls by reading the syscall numbers from a clean copy of ntdll.dll and executing the syscall instruction directly from the loader's own code.. User-mode EDR hooks are implemented by patching the entry points of functions inside ntdll.dll. Any call that goes through those functions, whether via the kernel32 wrapper or the Nt-prefixed export, passes through the hook. Direct system calls sidestep the problem by placing the syscall instruction in the loader's own code with the correct service number, so execution transitions to kernel mode without touching the hooked ntdll stubs. This is the most reliable way to bypass user-mode hooking without altering system DLLs.

Answer

Add the /DYNAMICBASE:NO linker flag so the loader's base address does not change between runs.

Answer

Replace the calls to VirtualAllocEx and CreateRemoteThread with their NtAllocateVirtualMemory and NtCreateThreadEx equivalents from ntdll.dll.

Answer

Call VirtualProtect on the ntdll.dll .text section to restore the original bytes before invoking the API.

Question 12

A penetration tester has a working PowerShell-based stager that is being blocked by AMSI on a Windows 11 target. The tester wants to keep using PowerShell for convenience but needs the stager to run without AMSI inspecting the script content. Which technique most directly targets AMSI's inspection of the script?

Accepted Answer

Obfuscate the stager and split it across multiple string concatenations and variable substitutions so the script text does not contain recognizable AMSI signatures.. AMSI inspects PowerShell script content by matching patterns against known malicious code. If the script text no longer contains those patterns, the inspection passes. Obfuscation through string splitting, concatenation, and dynamic construction changes the textual form while preserving the executed logic, so the stager runs. Execution policy and code signing are separate controls, and version downgrade is unreliable on patched Windows 11 systems where AMSI enforcement is not tied to the PowerShell version.

Answer

Set the PowerShell execution policy to Bypass using the -ExecutionPolicy Bypass parameter.

Answer

Sign the PowerShell script with a trusted code-signing certificate before execution.

Answer

Run the stager through a PowerShell downgrade to version 2 using the -Version 2 parameter.

Question 13

A penetration tester needs to deliver a Meterpreter payload to a Windows target protected by an EDR that performs both static file scanning and behavioral monitoring of process creation. The tester wants to reduce the chance of detection during initial execution while still obtaining a session. Which two techniques most directly reduce detection in this combined scenario? (Choose two.)

Accepted Answer

Spawn the payload by injecting into a legitimate, already-running process such as explorer.exe rather than starting a new process.. The scenario involves two distinct controls: static file scanning and behavioral process monitoring. A custom loader with encrypted shellcode removes recognizable bytes from disk, defeating static signatures. Injecting into an existing trusted process avoids the new-process creation event that behavioral engines monitor, placing execution inside a process already deemed legitimate. Together these address both controls. Renaming, UPX packing, and registry tampering either leave the static bytes intact or generate their own high-signal events.

Answer

Disable Windows Defender real-time protection by modifying the registry before executing the payload.

Answer

Rename the payload executable to svchost.exe and place it in the user's temp directory.

Answer

Compress the payload with UPX and deliver it as a self-extracting archive.

Question 14

A junior penetration tester is preparing a payload for a Windows 10 target and wants to avoid signature-based detection by changing the binary's appearance without altering its functionality. Which technique is specifically designed to achieve this?

Accepted Answer

Encoding the payload with msfvenom's shikata_ga_nai encoder multiple times.. Shikata_ga_nai is a polymorphic encoder that mutates the payload's bytes while preserving its functionality, directly targeting signature-based detection by changing the binary appearance. The other options either do not alter the binary signature, are easily unpacked, or change only the delivery mechanism rather than the payload's bytes.

Answer

Splitting the payload into multiple chunks and reassembling at runtime.

Answer

Running the payload from a remote SMB share instead of the local disk.

Answer

Compressing the payload with UPX to reduce its size.

Question 15

A penetration tester has written a C# loader that reads shellcode from a file, allocates memory with VirtualAlloc using PAGE_EXECUTE_READWRITE, and executes it via CreateThread. The loader is not detected by static antivirus signatures, but when run on a Windows 10 host with Microsoft Defender's real-time protection enabled, the process is terminated shortly after execution begins. The tester suspects behavior-based detection. Which modification is MOST likely to prevent this behavioral detection while preserving execution?

Accepted Answer

Use separate VirtualAlloc calls with PAGE_READWRITE then VirtualProtect to PAGE_EXECUTE_READ before execution.. The loader is being flagged behaviorally because it allocates memory with both write and execute permissions (RWX), a pattern rarely seen in legitimate software. Separating allocation and execution by using PAGE_READWRITE followed by VirtualProtect to PAGE_EXECUTE_READ removes the RWX indicator while still allowing shellcode execution. Other options either do not change the behavioral footprint or introduce additional suspicious activity.

Answer

Replace VirtualAlloc with VirtualAllocEx and allocate memory in a remote process.

Answer

Encrypt the shellcode with AES and decrypt it at runtime using a hardcoded key.

Answer

Add a call to Sleep with a random delay before executing the shellcode.