T1027.002: Software Packing
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.CitationESET FinFisher Jan 2018
Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.CitationAwesome Executable Packing
Security context for executives and security teams
Software Packing matters because it is a stealth technique that changes how executable files look to security tools. By compressing, encrypting, or virtualizing code, adversaries can make malware harder to match with signatures and may only reveal the real code after it runs in memory. For leaders, the decision point is whether endpoint defenses and SOC workflows can handle suspicious binaries that are not recognizable by known hashes or signatures.
Executive priority
Treat this as a validation item for endpoint security, malware triage, and incident response readiness across Windows, macOS, and Linux. ATT&CK links this technique to many campaigns and groups, including espionage, financially motivated, government, energy, and cyber-physical contexts such as the 2016 Ukraine Electric Power Attack. The priority is not to assume packed equals malicious, but to ensure the organization can identify, contain, and analyze packed or custom-protected executables before response decisions depend only on signature matches.
Technical view
T1027.002 is a sub-technique of Obfuscated Files or Information under the stealth tactic. The supplied ATT&CK text emphasizes that packing changes file signatures and often decompresses executable code in memory; virtual machine software protection can transform code into a format executed by a special VM. SOC and IR teams should validate controls against known packers such as UPX and MPRESS while also accounting for custom packers that may not leave known artifacts. The related detection strategy, DET0023, points defenders toward behavioral unpacking patterns rather than static signatures alone. The related mitigation is M1049 Antivirus/Antimalware, specifically signatures, heuristics, behavioral analysis, remediation, broad deployment, and automated updates.
Likely telemetry
- Endpoint antivirus/antimalware and EDR alerts for packed, compressed, encrypted, or heuristically suspicious executables
- Static file metadata and binary analysis results for PE, Mach-O, and ELF executables where available
- Process execution telemetry, including parent-child process lineage and command context
- Memory-oriented telemetry or forensic artifacts showing code unpacking or execution after decompression in memory
- File creation, modification, and quarantine events for newly introduced executables
Detection direction
- Validate that detection logic does not depend only on known file signatures, because packing is explicitly intended to change signatures.
- Use behavioral detection for unpacking patterns, consistent with the DET0023 relationship, and compare static-file findings with runtime behavior.
- Tune for false positives: legitimate commercial software can be packed or protected, so detections should consider signer, source, prevalence, execution path, and observed behavior.
- Test coverage on Windows, macOS, and Linux because those are the platforms supplied for this technique.
- Ensure triage workflows distinguish known packers such as UPX or MPRESS from unknown or custom packing methods that may not match known artifacts.
Mitigation priorities
- Maintain antivirus/antimalware coverage across endpoints and systems, with automated updates, as identified by M1049.
- Prioritize heuristic and behavioral analysis capability in addition to signatures, because the technique is designed to evade signature-based detection.
- Confirm that endpoint controls and response playbooks cover Windows, macOS, and Linux assets where executable malware risk is in scope.
- Establish malware triage procedures for suspicious packed binaries, including safe analysis and escalation to incident response when behavior is unclear.
- Use local allowlisting, software inventory, and trusted-source baselines to reduce noise from legitimate packed applications without ignoring unknown packed executables.
Additional notes and limits
ATT&CK relationships show broad historical use of Software Packing by multiple campaigns and groups, including Night Dragon, Operation Spalax, Operation Dust Storm, Operation Dream Job, the 2016 Ukraine Electric Power Attack, APT29, APT38, TA505, APT41, and others. This should influence preparedness and detection engineering, but it should not be treated as attribution by itself. The most important operational question is whether the SOC can move from a suspicious packed file to a defensible decision using behavioral evidence.
The official ATT&CK object provides no standalone detection text. Detection and mitigation guidance here is therefore constrained to the object description, the DET0023 detection-strategy relationship, the M1049 mitigation relationship, supplied platforms, tactics, and relationship context. Local environment baselines are required to separate benign packed software from malicious or suspicious packed executables.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Software Packing
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.CitationESET FinFisher Jan 2018
Utilities used to perform software packing are called packers. Example packers are MPRESS and UPX. A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.CitationAwesome Executable Packing
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.