I was wondering how threat actors actually test their exploits without them being automatically detected and added to the library of an antivirus detection system, thereby being marked as useless and shared with different vendors.

The simple answer would be turning off these detection methods, but how would they actually know if the exploit functions in the wild without being quickly marked as harmful?

  • 2
    The easiest approach is to test it against an AV engine that is disconnected from the Internet.
    – schroeder
    Feb 10 at 10:22
  • You ended up asking 2 different questions in one. Please keep to one question per post.
    – schroeder
    Feb 10 at 10:55

1 Answer 1


The easiest way to test malware to see if an AV detects it is to disconnect the testing machine from the internet so that the AV/EDR you are trying to evade can't phone home. But for a true "in the wild" test, it is very difficult to know until you run it against a live internet-connected target. It is up to the author to implement methods to bypass known mechanisms of detection which will buy as much time as possible for the malware to do its work.

Over time, all malware will be identified, it is just a matter of delaying this process. Obviously, the scope of malware distribution will play a part in this.

  • Mass-distributed ransomware will be picked up on pretty quickly as people discover their computers are locked
  • Malware targeting particular centrifuges in an Iranian nuclear facility might take a bit longer
  • Half of this answer look AI-generated, mostly because it misinterprets the question completely. Note that AI-generated questions are currently banned on SE, and next week, they require citation. But even if you wrote the whole thing yourself, it doesn't answer what was asked at all.
    – schroeder
    Feb 11 at 10:53
  • I don't know whether to be flattered that you think I'm an AI (I have been told my writing style is a bit strange before). The purpose of the answer was to provide insight into how AV/EDR works in order to explain what malware authors need to take into consideration when writing malware. The first examples were automated systems for detecting malware and culminating in the hardest "in the wild" test of all which is the manual analysis by a human. You thinking I'm an AI aside I don't see how that does not answer the question. Feb 11 at 20:01
  • But that's not what the question is. The question is, how to test against an AV without tipping off the AV vendor. Not "how does AV work and what tests would I need to pass?"
    – schroeder
    Feb 11 at 20:19
  • But by knowing how AV works and knowing what tests you need to pass means that if you pass those tests you will decrease your likelihood of tipping off the AV vendor. As part of a malware development course I am doing in the early modules we learn how to bypass the bog standard Windows defender. How do I guarantee that defender doesn't flag something and phone home - I can't, but knowing what it looks for and developing around that increases my chances of success. Yes my initial explanation goes beyond the specific question, but I believe it adds context to what needs to be evaded. Feb 12 at 0:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .