rapid7/metasploit-framework — pull request #904 by agix (2012-10-14 12:28:18+00:00)
Title: added exe-only options to win32pe generation

"msfencode -t exe" or "-t exe-small" are now detected by AV regardless of the template.
This is a patch "-t exe-only" that insert payload at the template entry point adding flag writable on the section Characteristics.
So only payload can be detected by AV.

RWX sections could increase the detection but it can't be the only criterion of detection.