T1027.014sub-technique of T1027 Obfuscated Files or Information

Polymorphic Code

Linux · macOS · Windowsnothing on this site yetT1027.014 on attack.mitre.org

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution. With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Polymorphic Code Mutation and Execution

Identifies self-modifying executables that exhibit changes in binary hash, entropy, or memory sections during or between executions, often tied to dynamic unpacking or decryption behaviors.
Detects files or processes where execution results in frequent re-creation or modification of ELF binaries or interpreter scripts, often using chmod + execve with abnormal entropy.
Tracks modification of executables or interpreter payloads (e.g., Mach-O, dylib) that mutate across runs, using scripting engines, JIT compilers, or side-loaded plugins.

what reduces it

M1040 Behavior Prevention on Endpoint. On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads
M1049 Antivirus/Antimalware. Anti-virus can be used to automatically detect and quarantine suspicious files. Employment of advanced anti-malware techniques that make use of technologies like machine learning and behavior-based mechanisms to conduct signature-less malware detection will also be more effective than traditional indicator-based detection methods.

the rest of T1027

T1027.001 Binary Padding · not covered yet
T1027.002 Software Packing · not covered yet
T1027.003 Steganography · not covered yet
T1027.004 Compile After Delivery · not covered yet
T1027.005 Indicator Removal from Tools · not covered yet
T1027.006 HTML Smuggling · not covered yet
T1027.007 Dynamic API Resolution · not covered yet
T1027.008 Stripped Payloads · not covered yet
T1027.009 Embedded Payloads · not covered yet
T1027.010 Command Obfuscation · 1 on this site
T1027.011 Fileless Storage · not covered yet
T1027.012 LNK Icon Smuggling · not covered yet
T1027.013 Encrypted/Encoded File · not covered yet
T1027.015 Compression · not covered yet
T1027.016 Junk Code Insertion · not covered yet
T1027.017 SVG Smuggling · not covered yet
T1027.018 Invisible Unicode · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.