Summary
In this chapter, we learned how to reveal which antivirus software is installed on an endpoint by using a WMI process enumeration technique and looked at the importance of adapting your antivirus bypass techniques to specific antivirus software. There are innumerable ways to implement a red team operation that includes antivirus software fingerprinting and antivirus bypass.
The Python code that we have used in this chapter was actually a small part of our stage-based malware attack that we used in one of our red team operations conducted on our clients legally.
In the next chapter, we will learn how antivirus vendors can improve most antivirus engines in order to prevent antivirus bypass.