T1027.002 Software Packing — Detection Rules

Detection workspace for T1027.002 Software Packing: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.

Source-backed rule directory

Python Image Load By Non-Python Process · test · low · {"product":"windows","category":"image_load"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0023 Obfuscated Binary Unpacking Detection via Behavioral Patterns

AN0066 Analytic 0066

Detection of unpacking behavior through abnormal memory allocation, followed by executable code injection and execution from non-image sections.

AN0067 Analytic 0067

Correlates ELF file execution with high-entropy writable memory segments and self-modifying code patterns.

AN0068 Analytic 0068

Detection of packed Mach-O binaries unpacking into memory and transferring control to dynamically modified code segments.

Connected ecosystem references

Linked tags

rule_source_available

Simulation, tools and telemetry

T1027.002 simulation workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.