Which endpoint security bypass technique modifies the assembly of an executable?

Living Off the Land uses legitimate, pre-installed system binaries such as PowerShell or certutil for malicious purposes without modifying their underlying assembly code.

Code signing is a security control that uses cryptographic certificates to verify software authenticity; it is a defensive mechanism, not an attack technique that modifies executables.

A keyed payload is designed to execute only under specific environmental conditions or with a decryption key, used to evade sandbox analysis, not to alter the assembly of an existing executable.

Ghostwriting involves rewriting or injecting instructions directly into the compiled assembly of an existing legitimate binary, altering its behavior without changing its external appearance in ways that standard scanners detect. Because the modified file may still appear to originate from a trusted source or match a superficially known-good profile, endpoint security products relying on signature matching can be bypassed. This distinguishes it from techniques that simply leverage existing tools or wrap payloads externally.