Since January I observed that meterpreter_reverse_https was detected by AV even with the enablestageencoding set to true. I tried to change the signature of the meterpreter and set the handlersslcert to true, without success. After this, I set the SSL option of web_delivery to true but still have the same problem. So, I switched to reverse_tcp_rc4 which worked perfectly until this weekend. Now it is also detected by Symantec.
One point which is important, when I take the source code of the meterpreter in PSH and execute directly in the powershell console, it works! I think that ips detects the signature of the communication between the victim and the web delivery server.
Can some one please explain to me how to resolve the problem? I really need it because I have a meterpreter session which launches periodically with this method.