# Antivirus Evasion

> Understand AV detection mechanisms and bypass them with payload obfuscation, custom encoding, and in-memory execution techniques.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/antivirus-evasion
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 0.5
- **Published:** 2026-09-24
- **Updated:** 2026-09-25

Modern targets run antivirus and endpoint detection. PEN-200 covers how AV detection works (signature-based, heuristic, behavioral) and techniques to bypass it: payload obfuscation, custom encoding, in-memory execution, and avoiding common signatures. Before attempting evasion, you need to know what security products are running on the target.

## Identifying Security Products

Enumerate installed AV, EDR, AMSI status, and application control policies before choosing your evasion approach. Knowing the exact product and configuration determines which techniques will work.

> [!WARNING]
> HackIndex does not currently have dedicated pages for payload obfuscation, custom shellcode encoding, or AV evasion techniques. Refer to the PEN-200 course material for hands-on evasion exercises.

## Study material

- [Windows Antivirus and EDR Enumeration](https://hackindex.io/platforms/windows/enumeration/windows-antivirus-and-edr-enumeration.md) (read, core)