Obfuscated Files or Information: Polymorphic Code (T1027.014)

Tactic: Stealth · Platforms: Linux, macOS, Windows

The interactive view maps 1 detection strategy, 2 mitigations, 1 software entry to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Obfuscated Files or Information (T1027).

Overview

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution. With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools. Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as Software Packing, Command Obfuscation, or Encrypted/Encoded File.

Explore

• Open T1027.014 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1027.014
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan