Which attack method relies on encoding payloads so the shellcode is rewritten on each delivery to avoid pattern matching?

Which attack method relies on encoding payloads so the shellcode is rewritten on each delivery to avoid pattern matching?

• A. ASCII shellcodes
• B. Fragmentation
• C. Polymorphic shellcode attacks
• D. Signature-based NIDS

Answer: (C)

Polymorphic shellcode mutates the payload so the bytes change with every delivery, while keeping the same functionality. It uses an encoding/decoder approach where the shellcode is rewritten each time (often with a different key or stub), so static pattern-based detectors can’t rely on a fixed signature to identify it. When the code runs, the decoder reconstructs the original shellcode in memory and then executes it, preserving the attack’s effect despite the changing on-wire appearance. This contrasts with ASCII shellcodes, which focus on representing the payload in ASCII to fit certain input constraints but don’t inherently mutate the payload across deliveries; fragmentation splits the payload to evade certain filters but isn’t about encoding to avoid pattern matching; and signature-based NIDS refers to detection methods, not a delivery technique. The best fit is polymorphic shellcode because it centers on encoding and rewriting to dodge pattern matching.

Polymorphic shellcode mutates the payload so the bytes change with every delivery, while keeping the same functionality. It uses an encoding/decoder approach where the shellcode is rewritten each time (often with a different key or stub), so static pattern-based detectors can’t rely on a fixed signature to identify it. When the code runs, the decoder reconstructs the original shellcode in memory and then executes it, preserving the attack’s effect despite the changing on-wire appearance. This contrasts with ASCII shellcodes, which focus on representing the payload in ASCII to fit certain input constraints but don’t inherently mutate the payload across deliveries; fragmentation splits the payload to evade certain filters but isn’t about encoding to avoid pattern matching; and signature-based NIDS refers to detection methods, not a delivery technique. The best fit is polymorphic shellcode because it centers on encoding and rewriting to dodge pattern matching.