I am busy with security testing on a clients network and was asked to show how "easy" AV evasion is. I created a nice powershell reverse HTTPS file through veil-evasion, which is not detected by the Symantec virusscanner (testing with Norton Deluxe).
So that was easy enough, but when I run it the IPS part of the virusscanner (I tested it, it is purely the IPS) still detects meterpreter network traffic. As far as I can see with Wireshark the connection gets to the "Hello, Certificate, Server Hello Done" message and is killed then and there.
My question is how does the IPS detect this? What in the meterpreter message is triggering this IPS? And then, what to use to circumvent this still using meterpreter (and not have to write my own backdoor)?