PEN-200 Antivirus Evasion — Timed 15 Questions

Question 1

An advanced evasion tool uses direct system calls (Syscalls) by extracting the syscall numbers from ntdll.dll and executing them using assembly. What is the primary advantage of this approach over using standard Windows API functions like NTWriteVirtualMemory?

15 minute time limit — choose an answer to begin.

Accepted Answer

It bypasses EDR hooks placed on user-mode API functions.. Endpoint Detection and Response (EDR) solutions typically monitor user-mode activity by 'hooking' common Windows API functions in ntdll.dll. When an application calls a hooked function, the EDR intercepts the call to inspect it. By using direct syscalls, an attacker bypasses these hooks entirely, communicating directly with the kernel and avoiding detection by the EDR's user-mode monitoring agents.

Answer

It allows the application to run with SYSTEM privileges automatically.

Answer

It ensures the payload is compatible with all versions of Windows.

Answer

It encrypts the parameters passed to the kernel to hide their intent.

Question 2

An ethical hacker is developing a custom C# loader to bypass Windows Defender on an engagement. The analyst notices that a simple reverse shell payload containing clear strings like 'cmd.exe' is immediately flagged on disk. Which technique is most effective for obfuscating these critical strings within the binary to prevent static signature detection?

Accepted Answer

Apply AES encryption to the strings and decrypt them into memory exclusively during runtime execution.. Encrypting or encoding critical strings like command execution binaries prevents signature scanners from matching known malicious patterns statically on disk. In OSCP-style engagements, relying on basic plaintext strings leaves binaries vulnerable to signature matching. Transforming these strings dynamically at runtime ensures the static footprint remains clean while preserving the functional behavior required during post-exploitation activities.

Answer

Compress the entire executable using standard UPX packing with default parameters.

Answer

Rename all internal variable names and function signatures using random alphanumeric characters.

Answer

Prepend dummy null-bytes to the beginning of the PE file header to alter the file hash.

Question 3

During an assessment, a penetration tester attempts to execute a staged Meterpreter payload via PowerShell, but AMSI (Antisimalware Scan Interface) blocks the script execution. Which TWO techniques can the tester employ to bypass or disable AMSI inspection effectively within the PowerShell session?

Accepted Answer

Locate the AmsiScanBuffer function address in memory and overwrite the initial bytes with a return instruction.. Bypassing AMSI is a fundamental skill for penetration testers operating within hardened Windows environments. Patching the amsiInitFailed function or overwriting the amsiContext buffer in memory effectively blinds the scanning interface, allowing subsequent malicious script blocks to execute without triggering inline antivirus alerts during red team operations.

Answer

Modify the Windows Registry to disable Windows Defender real-time protection permanently.

Answer

Run the PowerShell script inside an elevated prompt using the -NoProfile and -NonInteractive flags.

Answer

Inject the payload directly into the winlogon.exe process using standard CreateRemoteThread calls.

Question 4

You are attempting to deliver a custom payload to a target machine protected by signature-based antivirus. Despite obfuscating the payload, the AV continues to flag the binary on disk. Which technique is most effective at preventing the AV from performing static analysis on the file structure?

Accepted Answer

Implementing a custom loader that decrypts the actual payload into memory at runtime.. Static analysis often relies on detecting known patterns in the file headers and sections. By using custom packers or encrypting the payload in transit, you prevent the antivirus engine from identifying suspicious strings or imported functions. This is a fundamental evasion technique in the OSCP workflow because static signatures are the first line of defense; if the binary structure appears benign or randomized, the engine must trigger dynamic analysis, which is significantly more resource-intensive.

Answer

Stripping the symbol table and debug information from the compiled executable.

Answer

Modifying the program icon and metadata to mimic a legitimate system file.

Answer

Using a well-known public obfuscator to scramble the control flow of the binary.

Question 5

You are preparing a payload for a Windows environment with AMSI enabled. Which TWO of the following strategies are most effective at evading AMSI-based detection during the execution of script-based payloads?

Accepted Answer

Reflecting the AMSI.dll into memory to overwrite the AmsiScanBuffer function.. AMSI scans script content in memory before execution, making it a major hurdle for living-off-the-land techniques. Bypassing AMSI involves either neutralizing the inspection engine within the process memory or obfuscating the script to the point where the signature engine fails to identify it as malicious. These methods are vital for maintaining persistence or executing post-exploitation scripts without triggering immediate alerts from the Windows Defender engine during your engagement.

Answer

Using base64 encoding for the entire script file to hide its contents.

Answer

Adding excessive comments to the PowerShell script to confuse the engine.

Answer

Changing the file extension of the script from .ps1 to .txt.

Question 6

A penetration tester has obtained a Meterpreter shell on a Windows 10 host with Windows Defender active. The tester wants to upload and execute a known malicious tool without triggering Defender's real-time protection. Which evasion technique is most appropriate to achieve this?

Accepted Answer

Obfuscate the tool using a packer that changes its signature, then upload and execute it.. To evade Defender's real-time protection when uploading a known malicious tool, the tester should modify the tool's signature via packing or obfuscation. This prevents static detection, allowing the tool to be uploaded and executed without triggering alarms. Other options either do not address content scanning or involve risky actions like disabling Defender.

Answer

Disable Windows Defender's real-time protection via PowerShell before uploading the tool.

Answer

Upload the tool with a different file extension (e.g., .txt) and rename it after execution.

Answer

Use the 'migrate' command to move the Meterpreter session into a trusted process before uploading the tool.

Question 7

During a PEN-200 lab, you deliver a custom C# implant to a Windows 10 host running Microsoft Defender with cloud-delivered protection enabled. The implant uses direct P/Invoke to VirtualAlloc, CreateThread, and WaitForSingleObject. The payload executes successfully on your machine but is quarantined on the target before any callback is observed. Which single change is most likely to prevent quarantine while preserving the implant's behavior?

Accepted Answer

Replace the P/Invoke declarations with dynamically resolved function pointers obtained via GetProcAddress and delegate invocation.. Dynamic API resolution through GetProcAddress and delegate invocation eliminates the static import table entries that Defender's heuristics flag, directly addressing why the implant was quarantined on the target but not locally. The other options either alter timing, bitness, or trust signals without removing the indicators that caused pre-execution detection.

Answer

Sign the assembly with a self-signed code-signing certificate to satisfy Defender's trust requirements.

Answer

Add Thread.Sleep(5000) before the first network callback to stagger execution and avoid cloud submission.

Answer

Compile the implant with the /platform:anycpu flag so it runs under both 32-bit and 64-bit processes.

Question 8

A tester needs to deliver a payload to a Windows 10 target where outbound HTTP and HTTPS are inspected, and the tester wants to avoid writing the payload to disk. The tester plans to use a PowerShell download cradle to fetch and execute the payload directly in memory. Which combination of commands best achieves in-memory execution without touching disk?

Accepted Answer

Download the payload with Invoke-WebRequest, then reflectively load the assembly using [Reflection.Assembly]::Load().. In-memory execution requires the payload's bytes to be loaded directly into the process without a file intermediary. Invoke-WebRequest can hold the response in a variable, and [Reflection.Assembly]::Load() consumes a byte array to load a .NET assembly into the current process. Saving to TEMP, using certutil -urlcache, or using BITS/wmic all write the payload to disk, which conflicts with the scenario's constraint and exposes the file to real-time scanning.

Answer

Use bitsadmin /transfer to queue the payload, then use wmic process call create to run it from the cache.

Answer

Use certutil.exe -urlcache -split -f to download the payload to the current directory and execute it.

Answer

Invoke-WebRequest to save the payload to $env:TEMP, then Start-Process to launch it.

Question 9

A penetration tester is developing a custom C# loader to execute a shellcode payload on a Windows target with an EDR solution that monitors for suspicious API calls. The tester wants to avoid using the commonly flagged combination of VirtualAlloc with PAGE_EXECUTE_READWRITE and CreateThread. Which alternative memory allocation and execution strategy is MOST effective at reducing the loader's behavioral footprint?

Accepted Answer

Allocate memory with VirtualAlloc using PAGE_READWRITE, write the shellcode, then change the protection to PAGE_EXECUTE_READ with VirtualProtect before calling CreateThread.. The combination of VirtualAlloc with PAGE_READWRITE, writing shellcode, then VirtualProtect to PAGE_EXECUTE_READ avoids the classic RWX allocation that EDR solutions flag. By separating write and execute permissions, the loader does not create memory that is simultaneously writable and executable, which is a common heuristic. This reduces the behavioral footprint while still allowing execution via CreateThread. The other options either use heavily monitored remote injection, unusual native APIs, or executable heaps that are even more suspicious.

Answer

Use HeapCreate with HEAP_CREATE_ENABLE_EXECUTE and HeapAlloc to store and execute the shellcode.

Answer

Use NtCreateSection and NtMapViewOfSection to map the shellcode as an image section with execute permissions.

Answer

Use VirtualAllocEx to allocate memory in a remote process and write the shellcode, then use CreateRemoteThread to execute it.

Question 10

A penetration tester is preparing a payload for a Windows 10 target with Windows Defender real-time protection enabled. The tester wants to evade detection by leveraging trusted, signed Microsoft binaries rather than writing custom code. Which TWO techniques are most appropriate for this goal? (Choose two.)

Accepted Answer

Use mshta.exe to execute a remote HTA file that runs a PowerShell download cradle.. Mshta.exe and regsvr32.exe are both signed Microsoft binaries that can execute remote code without writing a custom executable to disk. Mshta executes remote HTA files, and regsvr32 with the scrobj.dll syntax executes remote scriptlets. Both techniques leverage trusted binaries to evade static detection and application whitelisting, making them the most appropriate choices for this goal.

Answer

Use wmic.exe to create a process that executes a remote payload directly from memory.

Answer

Use certutil.exe to download a base64-encoded payload and decode it to disk before execution.

Answer

Use bitsadmin.exe to transfer the payload from a remote server to the local disk.

Question 11

A penetration tester has gained a foothold on a Windows 10 host with Windows Defender and wants to execute a PowerShell-based reconnaissance script without triggering AMSI. The script contains strings such as 'Invoke-Mimikatz' and 'AmsiUtils'. Which technique is most effective for bypassing AMSI in this context?

Accepted Answer

Use the PowerShell reflection technique to set amsiInitFailed to true in the current process.. Setting amsiInitFailed to true via reflection disables AMSI for the current PowerShell process, preventing the script content from being scanned. This directly addresses the detection of suspicious strings like 'Invoke-Mimikatz'. Encoding, string splitting, and profile flags do not prevent AMSI from inspecting the script's content and behavior at runtime.

Answer

Split the suspicious strings into concatenated substrings within the script.

Answer

Base64-encode the entire script and execute it with powershell -EncodedCommand.

Answer

Run the script in a separate PowerShell process with the -NoProfile flag.

Question 12

An analyst is attempting to execute a custom C2 stager on a Windows 10 workstation with active Windows Defender. They decide to use a PowerShell one-liner that downloads a script from a remote server and executes it directly using the Invoke-Expression (IEX) cmdlet. Why is this method generally more effective than downloading an .exe file to the Desktop?

Accepted Answer

Memory-only execution avoids the file-on-disk signature scanning process.. In-memory execution avoids the creation of files on the physical disk, which is where most traditional antivirus solutions perform their primary signature-based scanning. By keeping the malicious payload within the volatile memory of the PowerShell process, the attacker minimizes the forensic footprint and reduces the likelihood of triggering alerts associated with suspicious file creation or modification events on the local file system.

Answer

It bypasses the Antimalware Scan Interface (AMSI) entirely by default.

Answer

PowerShell scripts are automatically trusted by the Windows integrity system.

Answer

The method uses the System.Net.WebClient class which encrypts the payload.

Question 13

A penetration tester modifies a known exploit's payload by changing variable names and adding junk instructions. Despite these changes, the antivirus software still flags the file as 'Trojan.Generic' immediately upon being written to disk. What is the most likely reason for this detection?

Accepted Answer

Heuristic analysis identified suspicious code patterns or structures.. While simple obfuscation like renaming variables can bypass basic string-matching signatures, modern antivirus engines use heuristic analysis to identify suspicious patterns or structures common to malware. If the core logic or the arrangement of functional code blocks remains recognizable, the heuristic engine will flag the file based on its similarity to known malicious software families even without an exact match.

Answer

The antivirus is using signature-based detection on the specific junk code.

Answer

The file's entropy was too low, triggering an automatic quarantine.

Answer

The junk instructions were identified as malicious shellcode by the CPU.

Question 14

Which TWO techniques are primarily used to bypass static signature-based detection by altering the file's binary appearance without changing its underlying functionality?

Accepted Answer

Binary Packing. Static evasion focuses on changing the 'look' of the file to bypass signature databases. Packing compresses the executable and adds a wrapper that unpacks it in memory, while encryption hides the payload entirely until runtime. Both techniques drastically change the file's hash and byte sequence, making it unrecognizable to scanners that rely on matching known malicious code patterns on disk.

Answer

Process Hollowing

Answer

Direct System Calls

Answer

Token Manipulation

Question 15

An attacker places a malicious 'version.dll' file into the same directory as a legitimate, signed executable that is known to load that DLL. When the legitimate program starts, it loads the malicious DLL instead of the one in the System32 folder. What evasion technique is being demonstrated?

Accepted Answer

DLL Sideloading. DLL Sideloading exploits the default search order that Windows uses to locate dynamic-link libraries. By placing a malicious DLL in the application's local directory, the attacker ensures it is loaded before the legitimate system DLL. This allows malicious code to run under the context of a trusted, signed process, which often bypasses security controls and behavioral alerts.

Answer

DLL Injection

Answer

COM Hijacking

Answer

Reflective DLL Loading