{"id":"T1027.001","name":"Binary Padding","url":"https://attack.mitre.org/techniques/T1027/001","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0553","stix_id":"x-mitre-detection-strategy--9c2a1b83-eec8-4d0c-a0b5-e5b561dbd68f","name":"Detection Strategy for Obfuscated Files or Information: Binary Padding","url":"https://attack.mitre.org/detectionstrategies/DET0553","analytics":[{"id":"AN1528","stix_id":"x-mitre-analytic--f9079cb0-76ff-4b4a-a73c-4f6572e7eef5","name":"Analytic 1528","description":"Detects the creation or execution of padded binary files (e.g., large size but minimal legitimate content) followed by process execution or lateral movement from the host.","url":"https://attack.mitre.org/detectionstrategies/DET0553#AN1528","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"FileSizeThresholdMB","description":"Threshold size in MB to determine suspicious padding"},{"field":"TimeWindow","description":"Correlation time window between file creation and execution"},{"field":"UserContext","description":"Scope the detection to suspicious or non-standard user accounts"}],"live":true,"detection_strategies":["DET0553"],"techniques":["T1027.001"]},{"id":"AN1529","stix_id":"x-mitre-analytic--5523b4ab-42b1-480a-854b-819879905f8d","name":"Analytic 1529","description":"Detects abnormal creation of binary files with significant size that are subsequently executed or accessed by non-standard users.","url":"https://attack.mitre.org/detectionstrategies/DET0553#AN1529","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"file_events","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"FileSizeThresholdMB","description":"Defines how large a file must be to consider it padded"},{"field":"UserContext","description":"Target abnormal user behavior outside of expected automation"},{"field":"TimeWindow","description":"Time window for correlating file creation and execution"}],"live":true,"detection_strategies":["DET0553"],"techniques":["T1027.001"]},{"id":"AN1530","stix_id":"x-mitre-analytic--d27caeb7-7af2-4a55-9dcb-734730c0ccf1","name":"Analytic 1530","description":"Monitors for anomalous binary files written to disk with padded size and subsequent execution by user or service context.","url":"https://attack.mitre.org/detectionstrategies/DET0553#AN1530","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process:spawn","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"file write","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"FileSizeThresholdMB","description":"Padded binary threshold for file size"},{"field":"TimeWindow","description":"Detection correlation window for execution after file creation"},{"field":"UserContext","description":"Filters for specific users or groups such as admin or service accounts"}],"live":true,"detection_strategies":["DET0553"],"techniques":["T1027.001"]}],"live":true,"version":"1.0","techniques":["T1027.001"]}],"sigma_rules":[{"id":"470ec5fa-7b4e-4071-b200-4c753100f49b","title":"Failed Code Integrity Checks","author":"Thomas Patzke","status":"stable","level":"informational","date":"2019-12-03","modified":"2025-01-19","description":"Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.\n","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027.001"],"path":"rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml","techniques":["T1027.001"],"cves":[]},{"id":"95361ce5-c891-4b0a-87ca-e24607884a96","title":"Binary Padding - MacOS","author":"Igor Fits, Mikhail Larin, oscd.community","status":"test","level":"high","date":"2020-10-19","modified":"2023-02-17","description":"Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md","https://linux.die.net/man/1/truncate","https://linux.die.net/man/1/dd"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1027.001"],"path":"rules/macos/process_creation/proc_creation_macos_binary_padding.yml","techniques":["T1027.001"],"cves":[]},{"id":"c52a914f-3d8b-4b2a-bb75-b3991e75f8ba","title":"Binary Padding - Linux","author":"Igor Fits, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2023-05-03","description":"Adversaries may use binary padding to add junk data and change the on-disk representation of malware.\nThis rule detect using dd and truncate to add a junk data to file.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1027.001"],"path":"rules/linux/auditd/execve/lnx_auditd_binary_padding.yml","techniques":["T1027.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}