tfMITRE ATT&CK sub-technique

Binary Padding T1027.001

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 05 February 2020
Last modified: 12 May 2026
Contributor: Martin Jirkal, ESET

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 16%

Tools & malware84th percentile · 84% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Binary Padding MITRE reference T1027.001

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

AkiraG1024 ↗

Has used binary padding to obfuscate payloads.1

created 2024-02-201 referenceaka GOLD SAHARA

HigaisaG0126 ↗

Performed padding with null bytes before calculating its hash.1

created 2021-03-051 reference

KimsukyG0094 ↗

Has performed padding of PowerShell command line code with over 100 spaces.1

created 2019-08-261 referenceaka Black Banshee

LeviathanG0065 ↗

Has inserted garbage characters into code, presumably to avoid anti-virus detection.1

created 2018-04-181 referenceaka MUDCARP

BRONZE BUTLERG0060 ↗

Downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.1 2

created 2018-01-162 referencesaka REDBALDKNIGHT

PatchworkG0040 ↗

Apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.1

created 2017-05-311 referenceaka Hangover Group

All 8 groups for this technique · 6 newest in this preview

22 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

HeartCryptS9018 ↗

Can add several hundred thousand kilobytes of null padding to payloads before saving onto the file system.1

created 2026-04-16MALWAREcarried by 1 group

CaminhoS9016 ↗

Can use junk code for obfuscation.1

created 2026-04-16MALWAREcarried by 1 group

TONESHELLS1239 ↗

Has used randomized padding to obfuscate payloads.1 2

created 2025-09-15MALWAREcarried by 1 group

LightSpyS1185 ↗

LightSpy's configuration file is appended to the end of the binary. For example, the last 0x1d0 bytes of one sample is an AES encrypted configuration file with a static key of 3e2717e8b3873b29.1

created 2025-01-03MALWAREcarried by 1 group

LatrodectusS1160 ↗

Has been obfuscated with a 129 byte sequence of junk data prepended to the file.1

created 2024-09-16MALWAREcarried by 2 groups

CHIMNEYSWEEPS1149 ↗

The CHIMNEYSWEEP installer has been padded with null bytes to inflate its size.1

created 2024-08-07MALWARE

All 22 software entries for this technique · 6 newest in this preview

Offense vs defense T1027.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0

first rule: 2019 Q4

Binary Padding detection strategy DET0553

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Obfuscated Files or Information: Binary Padding

Enterprise

3 platforms

AN1528 · Windows

Detects the creation or execution of padded binary files (e.g., large size but minimal legitimate content) followed by process execution or lateral movement from the host.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileSizeThresholdMB	Threshold size in MB to determine suspicious padding
TimeWindow	Correlation time window between file creation and execution
UserContext	Scope the detection to suspicious or non-standard user accounts

AN1529 · Linux

Detects abnormal creation of binary files with significant size that are subsequently executed or accessed by non-standard users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File CreationDC0039	linux:osquery	file_events
File AccessDC0055	auditd:SYSCALL	open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileSizeThresholdMB	Defines how large a file must be to consider it padded
UserContext	Target abnormal user behavior outside of expected automation
TimeWindow	Time window for correlating file creation and execution

AN1530 · macOS

Monitors for anomalous binary files written to disk with padded size and subsequent execution by user or service context.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process:spawn
File CreationDC0039	fs:fsusage	file write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileSizeThresholdMB	Padded binary threshold for file size
TimeWindow	Detection correlation window for execution after file creation
UserContext	Filters for specific users or groups such as admin or service accounts

Tests2Executorssh 2Need elevation0 of 2Have prerequisites2Have cleanup2Platformslinux, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Pad Binary to Change Hash - Linux/macOS dd linux, macos sh — 1 Yes

Uses dd to add a zero byte, high-quality random data, and low-quality random data to the binary to change the hash. Upon successful execution, dd will modify /tmp/evil-binary, therefore the expected hash will change.

Input arguments

Name	Type	Default	Description
file_to_pad	path	/tmp/evil-binary	Path of binary to be padded

Attack command

dd if=/dev/zero bs=1 count=1 >> #{file_to_pad} #adds null bytes
dd if=/dev/random bs=1 count=1 >> #{file_to_pad} #adds high-quality random data
dd if=/dev/urandom bs=1 count=1 >> #{file_to_pad} #adds low-quality random data

Cleanup command

rm #{file_to_pad}

Prerequisite

The binary must exist on disk at specified location (#{file_to_pad})

Check

if [ -f #{file_to_pad} ]; then exit 0; else exit 1; fi;

Satisfy

cp /bin/ls #{file_to_pad}

GUID9f9fa9d1-97b5-4716-8bdb-fbb14adb121b

02 Pad Binary to Change Hash using truncate command - Linux/macOS linux, macos sh — 1 Yes

Uses truncate to add a byte to the binary to change the hash. Upon successful execution, truncate will modify /tmp/evil-binary, therefore the expected hash will change.

Input arguments

Name	Type	Default	Description
file_to_pad	path	/tmp/evil-binary	Path of binary to be padded

Attack command

truncate -s +1 #{file_to_pad} #adds a byte to the file size

Cleanup command

rm #{file_to_pad}

Prerequisite

The binary must exist on disk at specified location (#{file_to_pad})

Check

if [ -f #{file_to_pad} ]; then exit 0; else exit 1; fi;

Satisfy

cp /bin/ls #{file_to_pad}

GUID228c2dc1-86d3-4a72-bca8-47416727b7dd

Tests from Atomic Red Team (MIT licence) · technique definition

Binary Padding detections T1027.001

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs