Modifying Metasploit x64 template for AV evasion

This blog post describes experiments modifying Metasploit's 64-bit PE template to evade Avast antivirus: the default template is detected, but simple assembly changes (such as increasing the payload buffer) caused Avast to miss the payloads and allowed successful remote shell execution. The author concludes that some AV engines match template assembly rather than payload shellcode and plans to repeat tests across other AV products.