- [Instructor] As organizations acquire and deploy
cybersecurity technologies to detect attack,
adversaries at the same time are analyzing
those same technologies to find ways
to avoid being detected by them.
As a pen tester, it's important to be able to use
evasive techniques to test how effective an organization is
in detecting such attacks.
We'll have a look at three different aspects of evasion.
The first is to evade detection.
There are many ways that a hacker will use
to avoid being detected by an intrusion detection
or prevention system.
We'll look at how we can use msfvenom to hide payloads
with obfuscation or encryption.
Custom packaging is also a technique used
to defeat malware signature checks.
The second aspect of evasion is for the malware
to avoid detection after it penetrates the target.
One way is to directly execute in memory,
an approach known as fileless malware.
Another way is to hide using undocumented
or little known features of the operating system,
such as by using cloaking,
and by embedding malware in an alternate data stream.
The final aspect of evasion is making analysis difficult
by detecting oversight and taking countermeasures.
Malware will often use anti-virtualization
and anti-sandboxing techniques for this.