During a Penetration Test, a Tester Identifies Traditional Antivirus Running

Multiple Choice

During a penetration test, a tester identifies traditional antivirus running on the exploited server. Which of the following techniques would BEST ensure persistence in a post-exploitation phase?

A) Shell binary placed in C:\windows\temp
B) Modified daemons
C) New user creation
D) Backdoored executables