Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1027.001sub-technique of T1027 Obfuscated Files or Information

Binary Padding

Linux · macOS · Windowsnothing on this site yetT1027.001 on attack.mitre.org

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Obfuscated Files or Information: Binary Padding

  • Detects the creation or execution of padded binary files (e.g., large size but minimal legitimate content) followed by process execution or lateral movement from the host.
  • Detects abnormal creation of binary files with significant size that are subsequently executed or accessed by non-standard users.
  • Monitors for anomalous binary files written to disk with padded size and subsequent execution by user or service context.

the rest of T1027

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.