T1027.014 — Polymorphic Code

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution. With each execution of the software, the code is mutated into a different version of…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.014 Obfuscated Files or Information: Polymorphic Code

title: "T1027.014 Obfuscated Files or Information: Polymorphic Code"
id: c617b56b-54a9-4e59-ad21-d4a4bed01988
description: 'Detection Strategy for Polymorphic Code Execution. NOTE: polymorphic/metamorphic mutation is defined by the same logical payload producing a different file hash on each execution/generation; this cannot be determined from a single Windows/Sysmon event, since it requires comparing hashes of the same Image path across multiple executions over time (better suited to a value_count correlation rule grouping ProcessCreate events by Image and counting distinct Hashes). As the closest single-event, Windows-observable proxy, this rule flags unsigned executables launched from user-writable paths, where mutating/dropper-style payloads are most commonly staged and re-executed. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: EntropyThreshold, TimeWindow, ParentProcessPatterns.'
references:
  - https://attack.mitre.org/techniques/T1027/014
author: Shahrukh Khan
date: 2026-01-12
license: MIT
tags:
  - attack.stealth
  - attack.t1027.014

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_unsigned_userpath_exec:
    Signed: 'false'
    Image|contains:
      - '\Users\'
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_unsigned_userpath_exec and not filter_system_account

falsepositives:
  - Unsigned in-house tooling, installers, and portable applications legitimately run from user-writable directories; this is a broad proxy and should be paired with a hash-diversity hunt/correlation rule for higher confidence.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: low

T1027.014 Obfuscated Files or Information: Polymorphic Code

title: "T1027.014 Obfuscated Files or Information: Polymorphic Code"
id: fd26b966-6945-4d5f-986e-33f6acba72b3
description: 'Detection Strategy for Polymorphic Code Mutation and Execution. Byte-level entropy deviation or mutation between successive executions cannot be measured from auditd telemetry at all, since no content-hash diffing across runs is available within a single event; the previous version flagged generic write or rename syscalls to /tmp/, a tautological busy-directory signal with no tie to polymorphism. Retargeted to the closest Linux-observable proxy: direct execution (EXECVE) of a binary staged in a world-writable scratch directory such as /tmp/, /var/tmp/, or /dev/shm/, the common precondition for running a freshly-dropped or re-generated payload. True mutation-engine detection requires an external file-integrity or hash-history system layered on top of this signal. Tune using: WriteExecThreshold, FileEntropyDeviation, ExecutionFrequency.'
references:
  - https://attack.mitre.org/techniques/T1027/014
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.stealth
  - attack.t1027.014

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    exe|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'

  condition: selection

falsepositives:
  - Many legitimate installers, package managers, and CI/build systems stage and execute helper binaries from /tmp or /dev/shm; this is a low-confidence proxy requiring allow-listing of known build/deploy tooling.

level: informational

T1027.014 Obfuscated Files or Information: Polymorphic Code

title: "T1027.014 Obfuscated Files or Information: Polymorphic Code"
id: a0d688c6-a2aa-4934-b076-48faaf7a7ac6
description: 'Detection Strategy for Polymorphic Code Mutation and Execution. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptEnginePatterns, MachOEntropyThreshold, SignedBinaryChangeRate.'
references:
  - https://attack.mitre.org/techniques/T1027/014
author: Shahrukh Khan
date: 2026-06-23
license: MIT
tags:
  - attack.stealth
  - attack.t1027.014

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains: '/Library/LaunchAgents/'
  selection_short:
    Image|contains: '/private/tmp/'
  condition: selection and selection_short

falsepositives:
  - Legitimate self-updating LaunchAgent helper tools that replace their own binary between runs, since polymorphic hash change and Mach-O entropy cannot be measured from process_creation events alone.

level: medium

Related sub-techniques

Explore