1. Home
  2. ATT&CK Techniques
  3. T1027.014 Polymorphic Code

T1027.014 Polymorphic Code

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone) Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as Software Packing, Command Obfuscation, or Encrypted/Encoded File.(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1027.014 Polymorphic Code
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    PR.IR-01.08 End-user device access Mitigates T1027.014 Polymorphic Code
    Comments
    This diagnostic statement implements technical controls (e.g., VPN, antivirus software) to address the risks of end-user personal computing devices accessing the organization’s network and resources.
    References
      PR.PS-01.01 Configuration baselines Mitigates T1027.014 Polymorphic Code
      Comments
      This diagnostic statement provides for securely configuring production systems. This includes hardening default configurations and making security-focused setting adjustments to reduce the attack surface, enforce best practices, and protect sensitive data thereby mitigating adversary exploitation.
      References
        PR.PS-05.01 Malware prevention Mitigates T1027.014 Polymorphic Code
        Comments
        Antivirus/Antimalware software can be utilized to detect and quarantine suspicious files that adversaries have made difficult to discover by encrypting, encoding or obfuscating.
        References
          PR.PS-01.08 End-user device protection Mitigates T1027.014 Polymorphic Code
          Comments
          This diagnostic statement protects against Polymorphic Code through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
          References

            NIST 800-53 Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            SI-03 Malicious Code Protection mitigates T1027.014 Polymorphic Code
            Comments
            As polymorphic code is difficult to detect via signature-based means, non-signature-based means, pointed out in this control, should be implemented for detection. Additionally, endpoint-level fortifications should be taken to prevent the malware from inflicting damage on systems.
            References

              VERIS Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1027.014 Polymorphic Code

              Azure Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              alerts_for_linux_machines Alerts for Linux Machines technique_scores T1027.014 Polymorphic Code
              Comments
              This control can detect obsfucation via polymorphic code.
              References
              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux
              alerts_for_windows_machines Alerts for Windows Machines technique_scores T1027.014 Polymorphic Code
              Comments
              This control can detect obsfucation via polymorphic code.
              References
              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
              2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines
              defender_for_app_service Microsoft Defender for Cloud: Defender for App Service technique_scores T1027.014 Polymorphic Code
              Comments
              This control can protect against obsfucation via polymorphic code.
              References
              1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction
              microsoft_antimalware_for_azure Microsoft Antimalware for Azure technique_scores T1027.014 Polymorphic Code
              Comments
              This control can protect against obsfucation via polymorphic code.
              References
              1. https://learn.microsoft.com/en-us/azure/security/fundamentals/antimalware

              GCP Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              cloud_ids Cloud IDS technique_scores T1027.014 Polymorphic Code
              Comments
              Google Cloud IDS can detect network-based threats like malicious software.
              References
              1. ['https://cloud.google.com/intrusion-detection-system'
              2. 'https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/threat-prevention/threat-signatures']

              M365 Mappings

              Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
              DEF-ATH-E5 Advanced Threat Hunting Technique Scores T1027.014 Polymorphic Code
              Comments
              Defender's advanced threat hunting capabilities can potentially detect suspicious or changing behaviors in programs, which can be indicative of polymorphic code.
              References
                DEF-ATH-E5 Advanced Threat Hunting Technique Scores T1027.014 Polymorphic Code
                Comments
                Defender's Advanced Threat Hunting can use Machine Learning models to identify malicious behavior, even if the code is polymorphic and attempts to disguise itself.
                References
                1. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicenetworkevents-table?view=o365-worldwide
                2. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-schema-tables?view=o365-worldwide
                3. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-emails-devices?view=o365-worldwide
                4. https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview?view=o365-worldwide