# Antivirus Evasion Methods in Modern Operating Systems
## 6 Experimental Procedures and Results for Antivirus Bypass Mechanisms
Similarly, if the payload is not detected during the static scan level, it receives one point, but if it completely bypasses antivirus security and connects to the meterpeter session, it receives two points. The more points the antivirus software receives, the less effective it is. Alternatively, the more points the masking technique obtains, the more dangerous it is. Table 5 displays the effectiveness of the tested tools, with Shellter ranking as the most dangerous tool in the first two positions: first with a raw load and second with a basic load. TheFatRat with the payload generated using the C language and PowerShell remains in third place, while the other tested mechanisms appear to pose only a slight threat. It \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline  & & \multicolumn{10}{c}{**AV Results**} \\ \cline{3-13}
**Payload** & **Online Scan** & \multicolumn{1}{c}{**AV1**} & \multicolumn{1}{c}{**AV2**} & \multicolumn{1}{c}{**AV3**} & \multicolumn{1}{c}{**AV4**} & \multicolumn{1}{c}{**AV5**} & \multicolumn{1}{c}{**AV6**} \\ \cline{3-13}  & & **S** & **A** & **S** & **A** & **S** & **A** & **S** & **A** & **S** & **A** & **S** & **A** \\ \hline \multicolumn{13}{l}{**Results obtained in January 2022**} \\ \hline
**Python** & 13/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline
**Powershell + Bash** & 10/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline
**PS + Bash + Hex** & 10/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline \multicolumn{13}{l}{**Results obtained in September 2022**} \\ \hline
**Python** & 14/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline
**Powershell + Bash** & 13/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline
**PS + Bash + Hex** & 12/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Veil-Evasion results. \begin{table}
\begin{tabular}{l c c c c c c c c c c c c c} \hline \hline  & & \multicolumn{10}{c}{**AV Results**} \\ \cline{3-13}
**Payload** & **Online Scan** & \multicolumn{1}{c}{**AV1**} & \multicolumn{1}{c}{**AV2**} & \multicolumn{1}{c}{**AV3**} & \multicolumn{1}{c}{**AV4**} & \multicolumn{1}{c}{**AV5**} & \multicolumn{1}{c}{**AV6**} \\ \cline{3-13}  & & **S** & **A** & **S** & **A** & **S** & **A** & **S** & **A** & **S** & **A** & **S** & **A** \\ \hline \multicolumn{13}{l}{**Results obtained in January 2022**} \\ \hline
**Shellter PP** & 5/26 & **N** & Y & **N** & **Y** & **N** & **Y** & **N** & **Y** & **Y** & **Y** & **N** & **Y** \\ \hline
**Shellter PPR** & 2/26 & **N** & **N** & **N** & **N** & **N** & **N** & **N** & **Y** & **N** & **Y** & **N** & **Y** \\ \hline \multicolumn{13}{l}{**Results obtained in September 2022**} \\ \hline
**Shellter PP** & 15/26 & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y & Y \\ \hline
**Shellter PPR** & 3/26 & Y & Y & Y & Y & **N** & **N** & **N** & **Y** & **Y** & **Y** & **Y** \\ \hline \hline \end{tabular} Note: PP—Primary payload, PPR—Primary payload with raw extension.  
\end{table} 
Table 3: Shellter results. should be noted that the tested tools offer many more possibilities and modifications, but this study focuses on the simplest and most accessible solutions available on the web. This highlights the fact that even with limited knowledge, a potential attacker has all the tools necessary to threaten an unsecured user. To complete the study, older versions of the AV2 antivirus software were tested. Versions 2008 and 2016 were obtained from the website oldversions.com and installed on virtual machines. After installation, infected files were sent to the virtual machines, and the malware scanning process was initiated. The results, as shown in Table 6, indicate that the older antivirus software was unable to detect the threat, even in the case of the basic payload. This is expected, as Msfvenom was developed much later.