Obfuscated Files or Information: Polymorphic Code
- ID
- T1027.014
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1027 Obfuscated Files or Information
- Platforms
- Linux, macOS, Windows
- Data sources
- Process Creation, Module Load, Process Access, File Modification, Process Metadata, File Creation, Process Modification
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.[1] With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.[2]
Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as Software Packing, Command Obfuscation, or Encrypted/Encoded File.[3][4]
Detection
- DET0324 Detection Strategy for Polymorphic Code Mutation and Execution
Data components: Process Creation, Module Load, Process Access, File Modification, Process Metadata, File Creation, Process Modification
Mitigations (2)
- M1040 Behavior Prevention on Endpoint
On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads
- M1049 Antivirus/Antimalware
Anti-virus can be used to automatically detect and quarantine suspicious files. Employment of advanced anti-malware techniques that make use of technologies like machine learning and behavior-based mechanisms to conduct signature-less malware detection will also be more effective than traditional indicator-based detection methods.