Detect packed malware

Hi all!
I have a question for the Reverse Engineering guys. Assume you have a malware packed with a common software (e.g. upx).

Ok you can unpack it and understand what it does, but if you want to write a detection rule that is able to find the packed version, is it actually feasible? Or is detecting the sample dynamically during runtime the only option that actually works?

can cybersecurity detect detection engineering find malware question reverse reverse engineering software understand unpack upx version