One of the way that i have found working is to generate shellcode from MSF venom remove bad chars from it.Then encrypting the shellcode and put it into a own written C program and when executing the code decrypt the shellcode and execute the shellcode using WIN API create process.You will bypass all static AV analysis.But you still probably,might get caught on dynamic analysis with defender.At the end of the day i have found MSF to be very noisy when it comes to AV

One way I found that works, is to:

• generate shellcode from msfvenom,
• then remove bad chars from it i.e. -b '\x00',
• then encrypt the shellcode,
• and put it into a self-written C program, which will decrypt and execute the shellcode, via CreateProcess

You will bypass all static AV analysis. But you still probably might get caught on dynamic analysis with Windows Defender.