Evasion and Obfuscation
In cybersecurity, mastering evasion and obfuscation techniques is critical for both offense and defense. With the rise of antivirus (AV) and Endpoint Detection and Response (EDR) systems, pentesters must now learn evasion skills traditionally used by red teams. Without these skills, your efforts to identify vulnerabilities and create exploit proofs of concept could be blocked, possibly leading to false negatives regarding system vulnerabilities.
This chapter focuses on using the Bash shell to implement these techniques, specifically in the context of evading detection by AV and EDR systems during pentesting activities. AV and EDR were formerly only found in Windows environments. Today, they are frequently deployed to Linux/Unix systems.
Throughout this chapter, we will explore various methods of creating and executing Bash scripts that minimize the risk of detection. We’ll begin by examining how to enumerate the environment for AV and EDR presence...
