WEBVTT

00:00:00.540 --> 00:00:04.490
Now that we have a good understanding of how Meterpreter and antivirus

00:00:04.490 --> 00:00:08.630
solutions work, let's take a closer look at why my Meterpreter stages

00:00:08.640 --> 00:00:12.790
are usually detected on disk and the various tools and techniques we

00:00:12.790 --> 00:00:15.340
can use to reduce detection rates.

00:00:15.470 --> 00:00:16.820
By the end of this module,

00:00:16.830 --> 00:00:20.330
you will be able to create highly evasive stages, which will not

00:00:20.330 --> 00:00:25.020
be detected on disk by most antivirus and EDR solutions. When it

00:00:25.020 --> 00:00:28.660
comes to evading detection on disk, there are several techniques

00:00:28.660 --> 00:00:29.780
that we need to cover.

00:00:29.970 --> 00:00:33.360
One approach which can be very effective is to write your own custom

00:00:33.360 --> 00:00:36.330
shellcode runner in the language of your choosing as we did

00:00:36.330 --> 00:00:39.090
previously in the Meterpreter Deep Dive module.

00:00:39.100 --> 00:00:45.530
I will also explain how the exe and exe‑only Metasploit formats work, and

00:00:45.530 --> 00:00:49.150
we will take a look at why you should not use the built‑in executable

00:00:49.150 --> 00:00:52.910
template file provided with the Metasploit framework when building a

00:00:52.910 --> 00:00:56.680
Meterpreter stager. We will also take a look at how we can obfuscate the

00:00:56.680 --> 00:01:01.090
stager using an encoder or an encryptor. Then, we will explore how you can

00:01:01.090 --> 00:01:05.340
modify the stager shellcode. We will take a look at how artificial

00:01:05.340 --> 00:01:09.420
intelligence and machine learning can be defeated. And finally, we will

00:01:09.420 --> 00:01:13.630
write our own custom stager from scratch to avoid some by‑design

00:01:13.630 --> 00:01:18.360
limitations of Metasploit‑generated stages and custom shellcode runners.