I just added an example to our GitHub repo that demonstrates how MAEC may capture behavior-based polymorphism across variants of the same family .
In this case, it's showing how different Zeus v1.x variants use certain hard-coded filenames in the same Behavior. Not quite polymorphism in the strictest sense, but it represents what we're able to capture right now. We'll have to think about how to better model this in the future; at this point we can state that particular CybOX Object property appears random (via appears_random, e.g. ), but there's no way to do so for Actions.
As far as server-side polymorphism, at this point I'm inclined to say that it would make the most sense to include as a MAEC Capability vocabulary entry.