Storm-0501G1053 ↗
Has used Themida to pack Cobalt Strike payloads.1
tfMITRE ATT&CK sub-technique
Software Packing T1027.002
sub-technique of T1027 Obfuscated Files or Information
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 05 February 2020
- Last modified
- 12 May 2026
- Contributor
- Filip Kafka, ESET
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
23
Threat groupsTop 8%
Threat groups92nd percentile · 92% of ATT&CK techniques have this many threat groups attributed or fewer.7
CampaignsTop 7%
Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.73
Tools & malwareTop 5%
Tools & malware95th percentile · 95% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Software Packing MITRE reference T1027.002
Top 8%of all ATT&CK techniques for number of groups
23 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Medusa GroupG1051 ↗
Has packed the code of dropped kernel drivers using the packer ASM Guard.1
Saint BearG1031 ↗
Clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.1
MoustachedBouncerG1019 ↗
Has used malware plugins packed with Themida.1
TA2541G1018 ↗
Has used a .NET packer to obfuscate malicious files.1
Volt TyphoonG1017 ↗
Has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.1
All 23 groups for this technique · 6 newest in this preview
7 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SharePoint ToolShell ExploitationC0058 ↗
During SharePoint ToolShell Exploitation, threat actors UPX-packed malicous payloads including 4L4MD4R ransomware.1
C0017C0017 ↗
During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.1
Operation SpalaxC0005 ↗
For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.1
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.123
2016 Ukraine Electric Power AttackC0025 ↗
During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.1
Operation Dust StormC0016 ↗
For Operation Dust Storm, the threat actors used UPX to pack some payloads.1
All 7 campaigns for this technique · 6 newest in this preview
73 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
HeartCryptS9018 ↗
Can pack malicious Windows x86 and .NET payloads in order to evade detection.12
RedLine StealerS1240 ↗
Has used obfuscation tools such as DNGuard and Boxed App to pack their code.1
SagerunexS1210 ↗
Has used VMProtect to pack and obscure itself.1
XLoaderS1207 ↗
Uses various packers, including CyaX, to obfuscate malicious executables.1
LockBit 3.0S1202 ↗
Troll StealerS1196 ↗
All 73 software entries for this technique · 6 newest in this preview
Offense vs defense T1027.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 4Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2020 Q2 · 4 of 7 campaigns plotted (2016 Ukraine Electric Power Attack (dated 2016), Operation Dust Storm (dated 2010) and 1 more fall before the 2017 window)Software Packing detection strategy DET0023
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Obfuscated Binary Unpacking Detection via Behavioral Patterns
3 platforms
AN0066 · Windows
Detection of unpacking behavior through abnormal memory allocation, followed by executable code injection and execution from non-image sections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessName | To scope detections to suspicious parent-child process relationships typical of loaders or droppers. |
| AllocationSizeThreshold | To tune for unusually large virtual memory allocations that might indicate unpacked payloads. |
AN0067 · Linux
Correlates ELF file execution with high-entropy writable memory segments and self-modifying code patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | auditd:SYSCALL | mprotect |
| Process CreationDC0032 | auditd:SYSCALL | execve |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| EntropyThreshold | Useful for tuning unpacked sections containing high entropy indicative of compression or encryption. |
| TimeWindow | Can be tuned to correlate file writes to execution within a set timeframe. |
AN0068 · macOS
Detection of packed Mach-O binaries unpacking into memory and transferring control to dynamically modified code segments.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process ModificationDC0020 | macos:endpointsecurity | ES_EVENT_MMAP |
| Process CreationDC0032 | macos:unifiedlog | process::exec |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SignedBinaryContext | Helps to distinguish between signed/unsigned packed binaries (common in legitimate vs. malicious cases). |
| UserContext | Can be used to scope to specific users or service accounts targeted in attacks. |
Employ heuristic-based malware detection. Ensure updated virus definitions and create custom signatures for observed malware.
Tests4Executorssh 4Need elevation0 of 4Have prerequisites0Have cleanup4Platformslinux, macos
Tests from Atomic Red Team (MIT licence) · technique definition