A fusion-center brief tells analysts that packing and string encryption hide indicators from scanners but do not themselves exploit a new vulnerability. How should the brief classify those techniques?

Packing and string encryption are anti-detection or obfuscation techniques: they impede signature matching, casual static inspection, and indicator extraction without, by themselves, exploiting a new vulnerability. A fusion-center brief that states these methods hide indicators from scanners but are not a distinct exploit class is classifying them correctly as obfuscation/anti-detection rather than as a vulnerability-exploitation method. Municipal analysts who keep that taxonomy straight avoid over-calling every packed sample an ‘zero-day exploit’ and instead focus defensive recognition on unpacking awareness, behavioral detection, and staged payload analysis.

Primary persistence via WMI event subscriptions fails because persistence is about surviving reboot/logon, not about packing or encrypting strings to hide from scanners. Network vulnerability scanning methodologies fail because scanning is an assessment practice for finding weaknesses, not malware obfuscation. Audio deepfake speech-sample requirements fail as a classification; deepfake prerequisites are a different domain and do not describe packing or string encryption.

Exam caveat: obfuscation can wrap exploits or payloads, but packing/string encryption alone are not ‘the exploit.’ GOAA Domain 6 rewards separating anti-detection obfuscation from exploit, persistence, and unrelated AI/media topics.

Operational check for fusion-center or city SOC training: teach analysts to note packed/encrypted-string evidence as obfuscation, pivot to behavioral and memory-oriented detections where appropriate, still hunt for the underlying dropper/downloader/payload roles, and avoid playbook branches that assume a brand-new vulnerability solely because a sample is packed.