Metasploit Deep Dive Part 9: Evasion in 2026, Honestly Assessed

A lot of Metasploit evasion advice still in circulation was accurate once and isn’t anymore. This post is written specifically to avoid repeating it. Where a claim below can’t be backed by the real framework source or a source that’s actually current, it says so.

Encoders: diminished, not dead

Part 3 covered shikata_ga_nai’s real docstring: a polymorphic XOR additive feedback encoder with dynamically ordered decoder stubs. In 2015, running a payload through five passes of shikata_ga_nai was enough to slip past most consumer AV products, because those products were doing static byte-signature matching against known decoder stub patterns, and enough polymorphism defeated that specific check. That is no longer true, and hasn’t been for years. Three separate things changed.

First, the decoder stubs themselves got signatured. Security vendors caught up to the specific instruction patterns shikata_ga_nai and its siblings generate, polymorphic or not, and started flagging the stub’s shape rather than its exact bytes.

Second, and more fundamentally, detection stopped being primarily static. Modern EDR watches behavior: a process that allocates executable memory, writes to it, and jumps into it is suspicious regardless of what byte pattern got it there. An encoder changes the bytes on disk or on the wire. It does nothing to the fact that, once decoded, the payload still does the thing the EDR is watching for.

Third, AMSI, the Antimalware Scan Interface, inspects script content and, on recent Windows builds, certain in-memory content before execution, at a layer encoders were never designed to address, since they predate AMSI by over a decade.

None of this means encoders are useless. alpha_mixed still solves a real, narrow problem: getting a payload through an injection point that only accepts printable ASCII. That’s a functional constraint, not an evasion claim, and it’s worth being precise about the difference. What encoders don’t do anymore, and mostly haven’t for years, is reliably defeat a modern EDR or a current AV engine on a well-maintained endpoint.

The dedicated evasion module category

The real clone has a separate modules/evasion/ directory, 12 modules as of this framework version, distinct from the 57 encoders. This category was added in 2018, specifically to generate payloads built from the ground up to route around AV/EDR rather than to encode an existing payload after the fact. Techniques in this category include process hollowing, direct syscalls that skip the user-mode API hooks EDR products commonly instrument, and AMSI bypass patches applied at generation time rather than left for the operator to apply by hand. This is a meaningfully different approach than encoding: an encoder disguises a payload’s bytes, an evasion module changes how the payload behaves at execution time to avoid the specific instrumentation points a defender is watching. It’s also the category most actively contested by defenders, since a technique that works against one EDR product’s hooking approach often doesn’t transfer to a different vendor’s implementation, and vendors patch specific bypasses once they’re public.

Reflective loading: still the actual advantage

The one architectural property that has held up since meterpreter’s earliest days is reflective DLL injection: the stage, once downloaded, is loaded directly into memory and never written to disk as a file. Antivirus products that scan files on disk, still a large share of real-world deployed AV, structurally cannot catch this, because there’s no file for them to scan. This isn’t a 2026 innovation, it’s close to the original design, but it remains genuinely effective against a whole category of detection for the simple reason that file-scanning AV is still common outside of well-resourced enterprise environments running full EDR. Where it does nothing is against memory-scanning EDR, which inspects process memory directly regardless of whether a file ever touched disk, and against behavioral detection, which doesn’t care where the code came from, only what it does once running.

What 6.5 actually shipped here

Two real, current features from Metasploit 6.5 belong in this discussion, and both were covered from the architecture side in earlier parts of this series.

Block API hash randomization, covered in Part 3, changes the 32-bit API-call hashes embedded in nearly all Windows shellcode on every generation, not just the instruction order. This directly addresses a known signature source: static hashes that stayed constant across generations became their own fingerprint independent of the surrounding code. Randomizing them closes that specific gap. It does not address behavioral detection at all, since the shellcode still calls the same Windows APIs in the same sequence once running; only the mechanism used to locate those APIs changes.

Malleable C2 profiles, covered in Part 4’s TLV discussion and Part 1’s release overview, reshape meterpreter’s HTTP(S) traffic to resemble legitimate browsing rather than Metasploit’s own default patterns. This is a network-evasion feature, not an endpoint one, and it’s the most honest kind of evasion claim this post can make: it doesn’t claim to defeat EDR or AMSI at all, it targets network-level detection specifically, the subject of Part 10, by making the traffic look like something a network monitor would allow.

The honest summary

Static, signature-based detection is a solved problem for a competent operator in 2026, and has been for a while; encoders, evasion modules, and reflective loading between them handle it. Behavioral EDR and memory scanning are not a solved problem, and no combination of Metasploit’s built-in tooling changes that on its own. The framework’s own 6.5 release notes reflect this split honestly: the new features target specific, named gaps (static API hashes, network traffic shape) rather than claiming a general AV/EDR bypass, which is a more accurate posture than a lot of third-party “FUD” (fully undetectable payload) tooling built around Metasploit claims to have.

Part 10 picks up the network side of this directly: what’s actually visible to a network monitor watching the transports covered in Part 5, narrowed deliberately to network-level signals, since host-based detection engineering is the subject of a separate series once its lab work lands.

Sources: Rapid7 blog: Hiding Metasploit Shellcode to Evade Windows Defender, Metasploit Framework 6.5 Released.