During a penetration test a tester Identifies traditional antivirus running on the exploited server. Which of the following techniques would BEST ensure persistence in a post-exploitation phase?

Shell binaries placed in C:\Windows\Temp are immediately suspicious because antivirus tools actively monitor temporary directories for executable files and would flag them on the next scan.

Traditional antivirus relies heavily on signature-based detection of new or modified files, and embedding persistence within existing system daemons means the malicious code runs inside processes the OS and AV already treat as trusted. Because no new binary is dropped and the daemon appears legitimate to the operating system, this technique bypasses the file-based and heuristic detection methods used by conventional antivirus software.

New user account creation is highly visible in system event logs and security monitoring tools, making it easily detectable by defenders and irrelevant to antivirus evasion.

Backdoored executables introduce modified binaries with altered code or behavioral patterns that are likely to trigger signature-based or heuristic antivirus detection.