T1027.002 Software Packing — Attack Simulation

Technique description

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Binary simply packed by UPX (linux)
  linuxautomatedsh

  Procedure 11c46cd8-e471-450e-acb8-52a1216ae6a4; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Binary packed by UPX, with modified headers
  macosautomatedsh

  Procedure 4d46e16b-5765-4046-9f25-a600d3e65e4d; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Binary simply packed by UPX
  macosautomatedsh

  Procedure b16ef901-00bb-4dda-b4fc-a04db5067e20; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• Binary packed by UPX, with modified headers (linux)
  linuxautomatedsh

  Procedure f06197f8-ff46-48c2-a0c6-afc1b50665e1; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.