OSCP · Module 11
Antivirus Evasion
Understand AV detection mechanisms and bypass them with payload obfuscation, custom encoding, and in-memory execution techniques.
~0.5 h 1 resource Last updated September 25, 2026
Modern targets run antivirus and endpoint detection. PEN-200 covers how AV detection works (signature-based, heuristic, behavioral) and techniques to bypass it: payload obfuscation, custom encoding, in-memory execution, and avoiding common signatures. Before attempting evasion, you need to know what security products are running on the target.
Identifying Security Products
Enumerate installed AV, EDR, AMSI status, and application control policies before choosing your evasion approach. Knowing the exact product and configuration determines which techniques will work.
Warning
HackIndex does not currently have dedicated pages for payload obfuscation, custom shellcode encoding, or AV evasion techniques. Refer to the PEN-200 course material for hands-on evasion exercises.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.