Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.[1] With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.[2] Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as Software Packing, Command Obfuscation, or Encrypted/Encoded File.[3][4]
| ID | Name | Description |
|---|---|---|
| S0574 | BendyBear |
BendyBear changes its runtime footprint during code execution to evade signature-based defenses.[5] |
| ID | Mitigation | Description |
|---|---|---|
| M1049 | Antivirus/Antimalware |
Anti-virus can be used to automatically detect and quarantine suspicious files. Employment of advanced anti-malware techniques that make use of technologies like machine learning and behavior-based mechanisms to conduct signature-less malware detection will also be more effective than traditional indicator-based detection methods. |
| M1040 | Behavior Prevention on Endpoint |
On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
The initial detection of a malicious tool or anomalous behavior may trigger an anti-virus or other security tool alert, and may be one of the only indications received before the code is able to mutate and evade the same type of detection. The alerting system should be thoroughly investigated beyond the initial alert for activity that may not have been detected. |
| DS0022 | File | File Creation |
Monitor for files with large entropy which don’t match what is normal/expected given the file type and location. |
| File Metadata |
Monitor for and analyze files which contain content with large entropy, as this may indicate potentially malicious compressed or encrypted data. |