tfMITRE ATT&CK sub-technique

Polymorphic Code T1027.014

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 27 September 2024
Last modified: 12 May 2026
Contributors: TruKno; Ye Yint Min Thu Htut, Active Defense Team, DBS Bank

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.[1] With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.[2] Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as Software Packing, Command Obfuscation, or Encrypted/Encoded File.[3][4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Polymorphic Code MITRE reference T1027.014

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

BendyBearS0574 ↗

Changes its runtime footprint during code execution to evade signature-based defenses.1

created 2021-02-16MALWARE

All 1 software entries for this technique

Offense vs defense T1027.014

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Polymorphic Code detection strategy DET0324

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Polymorphic Code Mutation and Execution

Enterprise

3 platforms

AN0919 · Windows

Identifies self-modifying executables that exhibit changes in binary hash, entropy, or memory sections during or between executions—often tied to dynamic unpacking or decryption behaviors.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EntropyThreshold	Tune based on expected baseline entropy for executables; higher values may indicate polymorphic packing.
TimeWindow	Correlate rapid process spawn + image load activity suggesting mutation engine usage.
ParentProcessPatterns	Define expected or suspicious parent-child chains (e.g., script runner -> encoded PE)

AN0920 · Linux

Detects files or processes where execution results in frequent re-creation or modification of ELF binaries or interpreter scripts, often using chmod + execve with abnormal entropy.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	auditd:SYSCALL	mmap
Process CreationDC0032	auditd:SYSCALL	execve
File ModificationDC0061	auditd:SYSCALL	chmod

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WriteExecThreshold	Tune to alert on write followed by chmod + exec in quick succession.
FileEntropyDeviation	Detect high deviation from average entropy score of baseline ELF/script files.
ExecutionFrequency	Abnormal burst executions of file with identical functionality but varying hash.

AN0921 · macOS

Tracks modification of executables or interpreter payloads (e.g., Mach-O, dylib) that mutate across runs—using scripting engines, JIT compilers, or side-loaded plugins.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_MMAP
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
Process MetadataDC0034	macos:unifiedlog	code signature/memory protection
File CreationDC0039	fs:fsusage	file open/write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptEnginePatterns	Detection may vary based on whether Python/Swift/AppleScript is used to mutate payloads.
MachOEntropyThreshold	Entropy tuning based on expected baseline for system vs user binaries.
SignedBinaryChangeRate	Helps flag apps that change but maintain signed status across invocations.

Polymorphic Code detections T1027.014

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs