I've been reading a lot about polymorphic and metamorphic malware and how they evade signature-based detection once they have been discovered. These techniques seem to be utilized to evade recurrent detections by AVs and IDSs. It occurred to me that it might be a high priority goal of malware authors to prevent their malware from being ever being analyzed in the first place. Are there any analogous techniques that malware authors have employed in order to prevent their malware from being first discovered so that they never get reported/analyzed in the first place?
As comments suggests, the subject of "malware vs. anti-virus software" as a whole is complex, and generally too broad for an answer here. However, I'd like to address what I believe may be a misconception on your part that led to your question.
In the question, you write (my emphasis):
I've been reading a lot about polymorphic and metamorphic malware and how they evade signature-based detection once they have been discovered.
and in a comment you add (also my emphasis):
I think those techniques are employed more to evade detection by AVs and IDSs once the malware has already been discovered, analyzed, and signatures extracted. I was wondering if there are any analogous techniques used specifically to prevent the malware's initial discovery so that no one would bother reporting, analyzing, or extracting signatures from it in the first place.
From my reading of the above, what I think you think happens is:
- Someone deploys a new piece of malware.
- It is discovered, analysed and "detection signatures" are extracted. AV software is now primed against the new malware.
- The malware now starts to use polymorphic measures to evade further detection.
I'm not an expert in the malware vs. anti-virus battle, but what I believe happens is more along the lines of:
- Various examples of existing malware are analysed and "detection signatures" are extracted. These can vary enormously in their complexity/subtlety, but at their simplest, these are sequences of bytes that any future malware – derived in a simplistic way from existing malware – are likely to contain.
- Someone creates a new piece of malware. To disguise its origins, and to try and evade existing "detection signatures", the writer adopts one or more polymorphic techniques.
- If "successful", the new malware won't be automatically detected by AV software: it will require manual detection. This would often only happen after the undesirable effects of the malware have triggered, and infected machines are forensically analysed.