Here is an example of what an antivirus could look like from a 1,000‑ft view.
At the bottom of the chart, we can see the kernel and the antivirus driver.
When an executable file is written to disk,
the driver would process the operation and scan the
file as it is being written to disk.
It could also inform the antivirus service that the
file has been written to disk, which could trigger static analysis of the file.
The service might also check the file's reputation in the
cloud and send it to an emulator or a sandbox,
as well as checking its hash against a database of known malicious file hashes.
On the right, we can see the process starting up,
assuming that the previous steps did not result in the file being quarantined.
When the process starts, the kernel notifies the driver,
which in turn can inject the API monitoring DLL into
the process and inform the service.
If the process happens to opt in to AMSI,
which is the case for PowerShell,
AMSI.dll would be loaded automatically inside the process.
Once the process starts executing, if it happens to be a Meterpreter stager,
it might call APIs, such as LoadLibraryA and VirtualAlloc.
These calls would be monitored by the API monitoring DLL.
If the Meterpreter stager is invoked using PowerShell,
the PowerShell script could be scanned by the AMSI provider.
The Microsoft Windows Threat Intelligence feed would also generate events for
the memory allocations made by the calls to VirtualAlloc.
These calls to VirtualAlloc may also trigger in‑memory scans
for known malicious artifacts at runtime.
Assuming that the stager still hasn't been detected,
it would start communicating over the network with the Metasploit handler,
which could result in the IP address and host name of the Metasploit
handler being recorded by the driver and sent to the service,
which in turn could check with cloud‑based threat intelligence
feeds if they are known to be malicious.
Finally,
the HTTP response containing the payload could also be scanned by the
network driver as it is being sent back by the handler.
As you can see, there are many ways an antivirus could detect our tradecraft.
Having a good understanding of these techniques will help you pinpoint
the reason your tools are being blocked by antivirus,
which in turn will help you evade detections.
It goes without saying that having access to multiple antivirus products
to test your tradecraft will be extremely helpful.