OSEP Antivirus Evasion Techniques Quiz

1. What is the purpose of XOR encoding in payload obfuscation?

To encrypt data using a symmetric key

To reduce payload size

To make the payload unreadable to static analysis

To speed up execution

2. Which Windows feature logs all PowerShell script blocks and can expose evasion attempts?

Script Block Logging

Module Logging

Transcription

All of the above

3. What is 'Process Hollowing' used for?

Injecting code into a suspended legitimate process

Removing unnecessary code from executables

Encrypting process memory

Disabling process monitoring

4. Which of the following is a technique to evade behavior-based detection?

Adding benign API calls between malicious ones

Using time delays

Mimicking legitimate application behavior

All of the above

5. What is the primary benefit of using a staging payload in evasion?

Reduces initial payload size to avoid detection

Increases execution speed

Improves encryption strength

Simplifies code complexity

6. Which technique involves modifying the entry point of an executable to execute malicious code first?

Code cave injection

Entry point modification

Reflective DLL injection

Process hollowing

7. What does 'Living off the Land' refer to in penetration testing?

Using built-in Windows tools to avoid custom malware

Testing malware on live systems

Deploying malware to external networks

Using free tools from the internet

8. Which PowerShell feature can be used to bypass script execution policies?

Bypass mode

-ExecutionPolicy Bypass

Constrained Language Mode

Script Block Logging

9. What is a 'fileless' malware attack?

Malware that exists only in RAM without touching disk

Malware compressed into a single file

Malware that uses encrypted files

Malware that disables file system access

10. Which technique involves hiding malicious code within legitimate application processes?

Code injection

Process hollowing

Living off the land

Code cave injection

11. What is the primary mechanism antivirus software uses to detect malware?

Signature-based detection

Behavioral analysis

Heuristic scanning

All of the above

12. Which Windows API function is commonly hooked by EDR solutions to detect process injection?

CreateRemoteThread

WriteProcessMemory

VirtualAllocEx

All of the above

13. What is the primary advantage of using a reflective DLL injection over standard DLL injection?

Faster execution

Avoids disk writes and LoadLibrary calls

Better performance

Simpler to implement

14. Which technique modifies code without changing its functionality to evade detection?

Obfuscation

Encryption

Encoding

Compression

15. What does EDR stand for in cybersecurity?

Endpoint Detection and Response

End-to-End Data Resilience

Enterprise Defensive Response

Endpoint Deployment and Recovery

16. Which of the following is a common method to bypass AMSI?

Hooking Windows APIs

Using encrypted PowerShell scripts

Patching AMSI.dll in memory

All of the above

17. What is a key difference between polymorphic and metamorphic malware?

Polymorphic changes encryption only; metamorphic rewrites code

Metamorphic is faster than polymorphic

Polymorphic is undetectable; metamorphic is not

There is no significant difference

18. Which technique involves breaking a payload into smaller chunks to avoid detection?

Polymorphism

Code fragmentation

Obfuscation

Polymorphic shellcode

19. What does AMSI stand for in the context of Windows security?

Advanced Malware Scanning Interface

Antimalware Scan Interface

Advanced Malware Security Integration

Antivirus Malware Signature Inspection

20. Which encoding method transforms binary data into a text-safe format commonly used for payload delivery?

Base64 encoding

XOR encryption

AES encryption

RSA encryption

OSEP Antivirus Evasion Techniques Quiz

1. What is the purpose of XOR encoding in payload obfuscation?

2.

What first name or nickname would you like us to use?

2. Which Windows feature logs all PowerShell script blocks and can expose evasion attempts?

3. What is 'Process Hollowing' used for?

4. Which of the following is a technique to evade behavior-based detection?

5. What is the primary benefit of using a staging payload in evasion?

6. Which technique involves modifying the entry point of an executable to execute malicious code first?

7. What does 'Living off the Land' refer to in penetration testing?

8. Which PowerShell feature can be used to bypass script execution policies?

9. What is a 'fileless' malware attack?

10. Which technique involves hiding malicious code within legitimate application processes?

11. What is the primary mechanism antivirus software uses to detect malware?

12. Which Windows API function is commonly hooked by EDR solutions to detect process injection?

13. What is the primary advantage of using a reflective DLL injection over standard DLL injection?

14. Which technique modifies code without changing its functionality to evade detection?

15. What does EDR stand for in cybersecurity?

16. Which of the following is a common method to bypass AMSI?

17. What is a key difference between polymorphic and metamorphic malware?

18. Which technique involves breaking a payload into smaller chunks to avoid detection?

19. What does AMSI stand for in the context of Windows security?

20. Which encoding method transforms binary data into a text-safe format commonly used for payload delivery?