T1027.001 — Binary Padding

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.001 Obfuscated Files or Information: Binary Padding

title: "T1027.001 Obfuscated Files or Information: Binary Padding"
id: e8e316cd-171e-4046-bfe6-e0e8a4c077a9
description: 'Detects binary padding via cmd.exe copy /b concatenation. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CommandLineExclusions, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1027/001
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.stealth
  - attack.t1027.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_copy_concat:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
      - 'copy'
      - '/b'
      - '+'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_copy_concat and not filter_system_account

falsepositives:
  - Legitimate scripts concatenating log/data files.

level: medium

T1027.001 Obfuscated Files or Information: Binary Padding

title: "T1027.001 Obfuscated Files or Information: Binary Padding"
id: d36d19df-68d5-436d-b09d-8db71a964459
description: 'T1027.001 Binary Padding: auditd does not natively report resulting file size, so a size-delta/checksum-change indicator cannot be derived from raw write/pwrite64 syscalls (which also fire constantly for benign I/O and mismatch the file_change category). Retargeted to explicit padding techniques observable via EXECVE argv: appending random junk to a file without truncating (dd conv=notrunc, cat /dev/urandom >> file) or explicitly growing a file past its content (truncate -s +N). Tune using: FileSizeThresholdMB, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/001
author: Shahrukh Khan
date: 2026-02-04
license: MIT
tags:
  - attack.stealth
  - attack.t1027.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_dd_pad:
    type: EXECVE
    a0|endswith: '/dd'
    a1|contains: 'conv=notrunc'
  selection_truncate_grow:
    type: EXECVE
    a0|endswith: '/truncate'
    a1|contains: '-s'
    a2|contains: '+'
  selection_shell:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
    a1: '-c'
  selection_shell_pad_pattern:
    a2|contains:
      - '/dev/urandom >>'
      - 'dd conv=notrunc'
      - 'truncate -s +'
  condition: selection_dd_pad or selection_truncate_grow or (selection_shell and selection_shell_pad_pattern)

falsepositives:
  - Legitimate disk-wipe/secure-delete tooling using dd conv=notrunc, or storage-provisioning scripts using truncate -s + to pre-allocate sparse files; both are uncommon on production hosts and worth confirming against known maintenance activity.

level: low

T1027.001 Obfuscated Files or Information: Binary Padding

title: "T1027.001 Obfuscated Files or Information: Binary Padding"
id: 9edbcfeb-36d2-40a1-8bef-d707c92f8ed6
description: 'Detection Strategy for Obfuscated Files or Information: Binary Padding. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FileSizeThresholdMB, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1027/001
author: Shahrukh Khan
date: 2026-04-04
license: MIT
tags:
  - attack.stealth
  - attack.t1027.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/dd'
      - '/truncate'
  selection_args:
    CommandLine|contains|all:
      - 'if=/dev/urandom'
      - 'of='
  condition: selection and selection_args

falsepositives:
  - Disk-wiping or test-fixture generation scripts that legitimately fill files with random data, since actual binary size growth cannot be confirmed from a process_creation event alone.

level: low

Related sub-techniques

Explore