A signature is a fingerprint. If the program changes its fingerprint every time it runs, a library of known fingerprints is of little use.
MITRE tracks this as Polymorphic Code, technique T1027.014, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Polymorphic code, also called metamorphic or mutating code, can change its runtime footprint while it executes. Each run produces a different version of itself that does the same job. This is aimed at traditional signature based defenses such as antivirus. MITRE adds that other techniques can be combined with it through mutation engines, including software packing, command obfuscation and encrypted or encoded files.
How to detect it
MITRE's strategy (DET0324) looks for the mutation itself:
- Windows. Self-modifying executables whose hash, entropy or memory sections change during or between runs, often tied to unpacking or decryption.
- Linux. Files or processes where running produces frequent re-creation or modification of ELF binaries or interpreter scripts, often with chmod and execve and abnormal entropy.
- macOS. Executables or interpreter payloads, such as Mach-O or dylib files, that change across runs through scripting engines, JIT compilers or side-loaded plugins.
Instead of asking whether you have seen this file before, ask whether this program keeps changing itself.
How to reduce the risk
MITRE lists two mitigations.
- Behavior prevention on endpoint. On Windows 10 and later, enable Attack Surface Reduction rules to prevent execution of potentially obfuscated payloads.
- Antivirus and antimalware. Detect and quarantine suspicious files, and use advanced anti-malware techniques, including machine learning and behavior based mechanisms, for signature-less detection.
The common thread is to stop relying on a fixed fingerprint. Continuous monitoring that records process behavior over time is the practical way to notice a program that keeps changing.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do hash blocklists fail against polymorphic code?
Each execution produces a different version of the code, so the hash you recorded last time will not match the next one.
Sources
- MITRE ATT&CK, Polymorphic Code (T1027.014)
