T1027.014No distinct observable

Polymorphic Code

StealthLinux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The defining observable of polymorphic code is that the artefact differs between two executions, which is a comparison across two events and therefore outside lib/sigma entirely (no aggregation, no timeframe, no cross-event join, no numeric comparison). Every analytic states it that way: AN0919 is 'changes in binary hash, entropy, or memory sections during or between executions' with an EntropyThreshold and a TimeWindow knob; AN0920 is 'frequent re-creation or modification of ELF binaries... with abnormal entropy', tuned by WriteExecThreshold, FileEntropyDeviation and ExecutionFrequency — explicitly a burst of executions with identical functionality but varying hash; AN0921 is a SignedBinaryChangeRate across invocations. […]

Covered instead by T1027, T1027.002, T1027.013, T1222.002, T1055.

What the technique is

Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution. With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools. Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as Software Packing, Command Obfuscation, or Encrypted/Encoded File.

Read it on attack.mitre.org

What MITRE says you would watch

AN0919
Identifies self-modifying executables that exhibit changes in binary hash, entropy, or memory sections during or between executions—often tied to dynamic unpacking or decryption behaviors.
AN0920
Detects files or processes where execution results in frequent re-creation or modification of ELF binaries or interpreter scripts, often using chmod + execve with abnormal entropy.
AN0921
Tracks modification of executables or interpreter payloads (e.g., Mach-O, dylib) that mutate across runs—using scripting engines, JIT compilers, or side-loaded plugins.