T1027.002sub-technique of T1027 Obfuscated Files or Information
Software Packing
Linux · macOS · Windowsnothing on this site yetT1027.002 on attack.mitre.org
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.
how MITRE says to see it
Obfuscated Binary Unpacking Detection via Behavioral Patterns
- Detection of unpacking behavior through abnormal memory allocation, followed by executable code injection and execution from non-image sections.
- Correlates ELF file execution with high-entropy writable memory segments and self-modifying code patterns.
- Detection of packed Mach-O binaries unpacking into memory and transferring control to dynamically modified code segments.
what reduces it
- M1049 Antivirus/Antimalware. Employ heuristic-based malware detection. Ensure updated virus definitions and create custom signatures for observed malware.
the rest of T1027
- T1027.001 Binary Padding
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.007 Dynamic API Resolution
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.010 Command Obfuscation
- T1027.011 Fileless Storage
- T1027.012 LNK Icon Smuggling
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode