Now that we have a good understanding of how Meterpreter and antivirus
solutions work, let's take a closer look at why my Meterpreter stages
are usually detected on disk and the various tools and techniques we
can use to reduce detection rates.
By the end of this module,
you will be able to create highly evasive stages, which will not
be detected on disk by most antivirus and EDR solutions. When it
comes to evading detection on disk, there are several techniques
that we need to cover.
One approach which can be very effective is to write your own custom
shellcode runner in the language of your choosing as we did
previously in the Meterpreter Deep Dive module.
I will also explain how the exe and exe‑only Metasploit formats work, and
we will take a look at why you should not use the built‑in executable
template file provided with the Metasploit framework when building a
Meterpreter stager. We will also take a look at how we can obfuscate the
stager using an encoder or an encryptor. Then, we will explore how you can
modify the stager shellcode. We will take a look at how artificial
intelligence and machine learning can be defeated. And finally, we will
write our own custom stager from scratch to avoid some by‑design
limitations of Metasploit‑generated stages and custom shellcode runners.