Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for T1027.014.
Upgrade to ProDetect Polymorphic Code in Microsoft Sentinel
This detection identifies behaviors associated with polymorphic or metamorphic malware that mutates its code or binary footprint at runtime to evade signature-based defenses. Because the binary hash changes with each execution, detections focus on behavioral indicators rather than static signatures: repeated file writes of executables with changing hashes, use of known mutation/packing engines, self-modifying process memory patterns, abnormal entropy in dropped files, and processes that write then immediately execute new PE files from temporary or user-writable directories. Correlation of these behaviors — especially when combined with Command and Scripting Interpreter activity or injection patterns — provides high-confidence indicators of polymorphic malware activity.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.014 Polymorphic Code
- Canonical reference
- https://attack.mitre.org/techniques/T1027/014/
KQL Detection Query
let PolyWriteThreshold = 3;
let LookbackWindow = 1h;
// Detect processes writing multiple distinct PE files to temp/user-writable paths in a short window
let WrittenPEs = DeviceFileEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".bin"
| where FolderPath has_any (@"\Temp\\", @"\AppData\\", @"\ProgramData\\", @"\Users\Public\\", @"C:\Windows\Temp\")
| summarize
UniqueHashes = dcount(SHA256),
FilesWritten = count(),
FileList = make_set(FileName, 20),
FolderList = make_set(FolderPath, 10)
by DeviceId, DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, InitiatingProcessCommandLine, InitiatingProcessAccountName
| where UniqueHashes >= PolyWriteThreshold;
// Join with process execution to see if those PEs were subsequently executed
let ExecAfterWrite = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FolderPath has_any (@"\Temp\\", @"\AppData\\", @"\ProgramData\\", @"\Users\Public\\", @"C:\Windows\Temp\")
| project
DeviceId,
ExecutedFile = FileName,
ExecutedSHA256 = SHA256,
ExecutedCommandLine = ProcessCommandLine,
ExecutedAccountName = AccountName,
ExecTimestamp = Timestamp;
WrittenPEs
| join kind=inner ExecAfterWrite on DeviceId
| project
DeviceName,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
InitiatingProcessAccountName,
UniqueHashes,
FilesWritten,
FileList,
FolderList,
ExecutedFile,
ExecutedSHA256,
ExecutedCommandLine
| extend AlertReason = strcat("Process wrote ", tostring(FilesWritten), " PE files with ", tostring(UniqueHashes), " distinct hashes to writable path, then executed one")Detects polymorphic malware behavior by identifying processes that write multiple PE files (executables or DLLs) with distinct SHA256 hashes to user-writable or temporary directories within a short time window, followed by execution of one of those files. The unique-hash threshold distinguishes polymorphic mutation from legitimate installers.
Data Sources
Required Tables
False Positives & Tuning
- Software update mechanisms that extract and execute multiple differently-hashed binaries (e.g., Chrome, Firefox, Edge auto-update components)
- Software packaging or build tools (MSBuild, CMake, Wix toolset) compiling and executing artifacts during developer workflows
- IT provisioning tools (SCCM, Intune, PDQ Deploy) deploying multiple distinct executables to endpoints simultaneously
Other platforms for T1027.014
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Polymorphic PE Mutation via XOR Re-encoding
Expected signal: DeviceFileEvents: 5 FileCreated events in %TEMP% with distinct SHA256 hashes, all with InitiatingProcessFileName=powershell.exe. Sysmon EventID 11 entries for each variant_N.bin file.
- Test 2Drop and Execute Multiple Renamed Copies of a Binary (Hash-Change via Append)
Expected signal: DeviceFileEvents: 4 FileCreated events for svc_update_N.exe in %TEMP% with distinct SHA256 hashes. DeviceProcessEvents: 4 ProcessCreate events for svc_update_N.exe running from %TEMP% with parent cmd.exe. Sysmon EventID 11 and 1 for each iteration.
- Test 3BendyBear-Style In-Memory Stub via PowerShell Reflection (Simulation)
Expected signal: DeviceProcessEvents: PowerShell process with unusual memory allocation patterns. If Defender for Endpoint AMSI/behavior monitoring is enabled: alerts on VirtualAlloc+VirtualProtect RW->RX page permission flip from powershell.exe. Process creation event for powershell.exe with -ExecutionPolicy Bypass flag.
References (5)
- https://attack.mitre.org/techniques/T1027/014/
- https://www.sentinelone.com/cybersecurity-101/polymorphic-malware/
- https://unit42.paloaltonetworks.com/bendybear/
- https://www.linkedin.com/pulse/polymorphic-malware-how-it-works-detection-evasion-/
- https://medium.com/@understanding-polymorphic-code-in-malware
Unlock playbooks & atomic tests with Pro
Get the full detection package for T1027.014 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month