Obfuscation my friends.... about poshc2

[riskydissonance]

Hey,

PoshC2 is open source (obviously) so the generated payloads are always likely to be heavily fingerprinted by AV.

You can take any of the generated .bin files in the payloads directory and use specialist AV evasion tools such as Veil, Unicorn etc, but it's always best to just take them and use those to create your own payloads that inject that shellcode.

Similarly you can take the generated binaries and manipulate them, such as encrypting them or packing them or finding the guilty bytes/behaviour and changing them, or take any of the generated sources files, such as the .c and .cs files, and edit those until the compiled payload no longer gets flagged.

Unfortunately the TL;DR is we give you the tools, but you have to do it yourself.