Bypassing an IDS

In Chapter 6, Malware Development, and Chapter 7, Advanced Malware, we developed our malware program, and in Chapter 8, Post Exploitation, we learned how to package our malware into a trojan. Our malware works great and most probably will not be detected by the IDS if it is using a signature-based approach since the malware is written by you and no signature exists for your program anywhere. However, modern IDSes are quite clever and after a couple of runs, they will start noting suspicious behaviors for which they use very exhaustive methods. In this section, we will try to see how we can run our Python executable and administrator privileges. This will help to achieve certain tasks on the victim's machine that a normal executable will not be able to do. For example, disabling the antivirus program on Windows, or creating an exception for a certain folder so that the virus scanner doesn't scan it, requires administrator privileges in Windows. You can&apos...