Sub-technique of T1027 Obfuscated Files or Information.View on attack.mitre.org
Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution. With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.
Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as Software Packing, Command Obfuscation, or Encrypted/Encoded File.
Rules on DetectionCode tagged with T1027.014.
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| MalwareBendyBear | BendyBear changes its runtime footprint during code execution to evade signature-based defenses. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
