Cross-source coverage
T1027.002 / ATT&CK
Obfuscated Files or Information: Software Packing
5 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogmacos:endpointsecurity
How MITRE says to detect it DET0023
Obfuscated Binary Unpacking Detection via Behavioral Patterns
Windows Analytic 0066
Detection of unpacking behavior through abnormal memory allocation, followed by executable code injection and execution from non-image sections.
WinEventLog:SysmonEventCode=10WinEventLog:SysmonEventCode=1
Linux Analytic 0067
Correlates ELF file execution with high-entropy writable memory segments and self-modifying code patterns.
auditd:SYSCALLexecveauditd:SYSCALLmprotect
macOS Analytic 0068
Detection of packed Mach-O binaries unpacking into memory and transferring control to dynamically modified code segments.
macos:unifiedlogprocess::execmacos:endpointsecurityES_EVENT_MMAP
socfortress/Wazuh-Rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Execution of packed binary from /tmp (Likely obfuscated or staged payload) | Medium | Wazuh XML |
| Execution of packed binary (UPX or modified header - software packing detected) | Medium | Wazuh XML |
| Shell executed packed binary from /tmp (Software packing or staging activity) | Medium | Wazuh XML |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| Python Image Load By Non-Python Process | Low | Sigma |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Execution of a DNGUard Protected Program | Undefined | Elastic TOML |