T1027.016sub-technique of T1027 Obfuscated Files or Information

Junk Code Insertion

Linux · macOS · Windowsnothing on this site yetT1027.016 on attack.mitre.org

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Junk Code Obfuscation with Suspicious Execution Patterns

Detects the presence of executables with high NOP padding, unusually large binary size for their function, and follow-on execution or memory injection from such files, especially when originating from temp or user-space paths.
Detects ELF binaries written to disk that demonstrate anomalous file size or entropy, quickly followed by execution or memory region writes into remote processes (e.g., using ptrace).
Identifies Mach-O binaries dropped into temporary directories with abnormally high binary size or padding patterns, followed by privilege escalation, `exec`, or memory mapping of other processes.

what reduces it

M1049 Antivirus/Antimalware. Anti-virus can be used to automatically detect and quarantine suspicious files. Behavior-based detections, rather than reliance on static code analysis, may help to identify malicious files that rely heavily on junk code.

the rest of T1027

T1027.001 Binary Padding · not covered yet
T1027.002 Software Packing · not covered yet
T1027.003 Steganography · not covered yet
T1027.004 Compile After Delivery · not covered yet
T1027.005 Indicator Removal from Tools · not covered yet
T1027.006 HTML Smuggling · not covered yet
T1027.007 Dynamic API Resolution · not covered yet
T1027.008 Stripped Payloads · not covered yet
T1027.009 Embedded Payloads · not covered yet
T1027.010 Command Obfuscation · 1 on this site
T1027.011 Fileless Storage · not covered yet
T1027.012 LNK Icon Smuggling · not covered yet
T1027.013 Encrypted/Encoded File · not covered yet
T1027.014 Polymorphic Code · not covered yet
T1027.015 Compression · not covered yet
T1027.017 SVG Smuggling · not covered yet
T1027.018 Invisible Unicode · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.