T1027.002 — Software Packing

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.002 Obfuscated Files or Information: Software Packing

title: "T1027.002 Obfuscated Files or Information: Software Packing"
id: daabff0d-033d-49bb-b75c-80fd72768e6d
description: 'Detection Strategy for Software Packing / Packer Tooling Usage. Detects execution of known executable packers/protectors on the host (UPX, MPRESS, ASPack, Petite, Themida, VMProtect, Enigma). NOTE: an already-packed binary executing is not distinguishable from any other process launch via a single Sysmon/Security event (no entropy or section-table data is present in ProcessCreate); this rule instead detects the packer tooling itself being run, the closest defensible Windows-observable proxy. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcessName, Image, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/002
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.stealth
  - attack.t1027.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_packer_image:
    Image|endswith:
      - '\upx.exe'
      - '\mpress.exe'
      - '\aspack.exe'
      - '\petite.exe'
      - '\themida.exe'
      - '\vmprotect.exe'
      - '\enigmaprotector.exe'
  selection_packer_cli:
    CommandLine|contains:
      - 'upx.exe'
      - '--ultra-brute'
      - '--best'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Legitimate software build/release pipelines that pack their own installers with UPX or similar tools.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1027.002 Obfuscated Files or Information: Software Packing

title: "T1027.002 Obfuscated Files or Information: Software Packing"
id: b803b9e3-aa64-4cc7-b2ed-0b3ced1e38df
description: 'Software Packing Detection - Weak On-Host Proxy. Genuine packed-binary detection relies on section entropy and structural analysis of the executable file itself, fields auditd process telemetry does not expose; the prior version implied entropy/time-window behavioral analysis in its tuning fields but the actual logic only matched direct execution of the upx binary, and real attackers almost always pack payloads pre-delivery rather than running a packer on the compromised host. This rule is retained only as a weak proxy for on-host packing/unpacking tool usage (upx, and upx -d unpacking); it does not detect the presence of an already-packed binary. Genuine detection requires binary/section-entropy analysis (YARA, PE/ELF structural tooling) independent of host process telemetry. Tune using: KnownPackerList.'
references:
  - https://attack.mitre.org/techniques/T1027/002
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.stealth
  - attack.t1027.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/upx'

  condition: selection

falsepositives:
  - Legitimate developers and build pipelines invoking upx to reduce binary size for distribution; this rule cannot detect packed binaries delivered pre-packed, which is the more common real-world attacker pattern.

level: low

T1027.002 Obfuscated Files or Information: Software Packing

title: "T1027.002 Obfuscated Files or Information: Software Packing"
id: 4666744c-e0cf-472a-a346-8e5babbdba59
description: 'Obfuscated Binary Unpacking Detection via Behavioral Patterns. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SignedBinaryContext, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1027/002
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.stealth
  - attack.t1027.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/spctl'
    CommandLine|contains|all:
      - '-a'
      - '-v'
  selection_tmp:
    ParentImage|contains: '/private/tmp/'
  condition: selection and selection_tmp

falsepositives:
  - Developers testing unsigned or ad-hoc-signed builds locally before notarization, since packer/protector signatures themselves are not distinguishable from unified log fields.

level: medium

Related sub-techniques

Explore