I85PREP
⌘ K
OSCE3 study materials
OSCE3 study resources

OSCE3: Evasion Techniques and Breaching Defenses

OSCE3 · Work through your exam, one topic at a time.

All guide sections

Evasion Techniques and Breaching Defenses

This domain tests payload delivery and execution against defensive controls: antivirus, EDR, AMSI, PowerShell logging, application allowlisting, network filtering, and credential protection. Success means getting code to run, keeping it running, and moving across network boundaries without relying on disabled defenses.

Core rules and concepts

  • Understand what each control observes. AMSI inspects content passed to script hosts; PowerShell logging records script blocks; EDR may hook process, memory, and network events.
  • In-memory execution reduces disk artifacts but does not automatically evade memory scanners. Reflective loading, assembly staging, and process injection each leave different telemetry.
  • Obfuscation is not a strategy by itself. The loader, execution primitive, and network profile must all be plausible.
  • Living-off-the-land binaries and signed utilities can bypass allowlisting, but command lines and parent-child relationships are logged.
  • Pivoting requires more than a port forward: consider DNS, proxy-aware tooling, SMB, WinRM, and egress filtering.
  • Credential Guard and LSA protections change what dumping techniques work; plan around them rather than assuming lsass access.

Worked example

A target blocks unsigned executables and has AMSI enabled. A signed script host is available. The operator chooses a staged approach: a benign-looking loader retrieves an encrypted payload, decrypts it in memory, and loads a .NET assembly reflectively. The reasoning is that disk execution is blocked, so the payload must not be written as an executable; AMSI may inspect the script content, so the loader avoids obvious signatures and splits the payload. The team validates that the assembly loads, that outbound traffic matches the expected profile, and that the technique does not trigger a reboot-persistent artifact requirement.

Traps that cost marks

  • Assuming an AMSI bypass is universal across script hosts and versions.
  • Using a noisy loader that works locally but fails behind a proxy or egress filter.
  • Forgetting that command-line logging captures arguments even when the payload is in memory.
  • Testing only against Windows Defender and not the exam's actual control set.