tfMITRE ATT&CK sub-technique

Junk Code Insertion T1027.016

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 04 March 2025
Last modified: 12 May 2026
Contributor: Joas Antonio dos Santos, @C0d3Cr4zy

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 19%

Tools & malware81st percentile · 81% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Junk Code Insertion MITRE reference T1027.016

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has used junk code within their DLL files to hinder analysis.1 2

created 2021-04-122 referencesaka TA416

APT-C-36G0099 ↗

Has used junk characters to obfuscate malicious scripts.1

created 2020-05-051 referenceaka Blind Eagle

KimsukyG0094 ↗

Has obfuscated code by filling scripts with junk code and concatenating strings to hamper analysis and detection.1

created 2019-08-261 referenceaka Black Banshee

APT32G0050 ↗

Includes garbage code to mislead anti-malware software and researchers.1 2

created 2017-12-142 referencesaka SeaLotus

Gamaredon GroupG0047 ↗

Has obfuscated .NET executables by inserting junk code.1

created 2017-05-311 referenceaka IRON TILDEN

FIN7G0046 ↗

Has used random junk code to obfuscate malware code.1

created 2017-05-311 referenceaka GOLD NIAGARA

All 6 groups for this technique

Offense vs defense T1027.016

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Junk Code Insertion detection strategy DET0322

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Junk Code Obfuscation with Suspicious Execution Patterns

Enterprise

3 platforms

AN0913 · Windows

Detects the presence of executables with high NOP padding, unusually large binary size for their function, and follow-on execution or memory injection from such files, especially when originating from temp or user-space paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
NOPThreshold	High proportion of 0x90 opcodes indicating junk code – tune to suppress noise from some packing tools
ExecutableSizeThreshold	Size range for abnormally large binaries relative to their runtime behavior
TimeWindow	Window between file creation and execution – short intervals may indicate staged payload execution

AN0914 · Linux

Detects ELF binaries written to disk that demonstrate anomalous file size or entropy, quickly followed by execution or memory region writes into remote processes (e.g., using ptrace).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	auditd:SYSCALL	SYSCALL ptrace/mprotect
Process CreationDC0032	auditd:SYSCALL	execve
File CreationDC0039	auditd:SYSCALL	write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BinarySizeThreshold	Used to flag binaries much larger than typical shell utilities or payloads
MemoryWriteTargets	Which processes are allowed ptrace/mprotect – can limit to suspicious child-to-parent targeting
ExecutionAfterWriteWindow	Temporal threshold for file write to execution

AN0915 · macOS

Identifies Mach-O binaries dropped into temporary directories with abnormally high binary size or padding patterns, followed by privilege escalation, exec, or memory mapping of other processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process ModificationDC0020	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_MMAP
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
Process AccessDC0035	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_OPEN

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TempFilePaths	Track dropped executables in ~/Library/, /tmp/, or /private/tmp/
MachOPaddingThreshold	Define padding size or section entropy anomalies in Mach-O file format
FollowOnPrivilegeEscalation	Detects whether the binary attempts privilege escalation within short execution window

Junk Code Insertion detections T1027.016

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs