T1027.016 — Junk Code Insertion

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.016 Obfuscated Files or Information: Junk Code Insertion

title: "T1027.016 Obfuscated Files or Information: Junk Code Insertion"
id: f780446f-e80a-43e8-a951-e7b0f03c1e23
description: 'Detection Strategy for Junk/Dead Code Obfuscation. NOTE: junk code insertion is a static-analysis evasion technique that pads a binary instruction stream with non-functional code; it leaves no distinct runtime signature in Windows/Sysmon telemetry (no field exposes code entropy, NOP density, or instruction padding), so no Windows event can genuinely detect it. As the closest defensible, explicitly weak proxy, this rule flags new PE binaries (.exe/.dll) dropped into user-writable paths, a common precursor to execution of obfuscated/padded malware, and should be paired with static/YARA analysis of the dropped file for actual confirmation. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: ExecutableSizeThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/016
author: Shahrukh Khan
date: 2026-03-29
license: MIT
tags:
  - attack.stealth
  - attack.t1027.016

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection_pe_drop:
    EventID: 11
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
    TargetFilename|contains:
      - '\Users\'
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_pe_drop and not filter_system_account

falsepositives:
  - Legitimate application installers and updaters that drop PE binaries into user-writable paths; this rule is an intentionally weak, low-confidence proxy and will require static analysis of the dropped file to confirm junk-code obfuscation.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: low

T1027.016 Obfuscated Files or Information: Junk Code Insertion

title: "T1027.016 Obfuscated Files or Information: Junk Code Insertion"
id: fe87fe7d-8f0d-4251-b7f1-0786b4aaef47
description: 'Junk/dead-code insertion (NOP padding, non-functional branches) is a compile-time static obfuscation technique with no runtime syscall or file-event signature of its own -- it is NOT observable via Linux auditd telemetry at all; genuine detection requires static/binary analysis (disassembly, entropy analysis, YARA) of the file at rest, not a runtime auditd event. Since the audit trail cannot see obfuscation itself, this rule is retargeted to the closest defensible Linux-observable proxy: a shared object or binary written into a world-writable/temp location and then executed from that same path shortly after (a generic drop-and-execute pattern common to obfuscated/packed malware droppers, but not specific to junk-code obfuscation). Treat findings as low-confidence triage leads only. Tune using: BinarySizeThreshold, MemoryWriteTargets, ExecutionAfterWriteWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/016
author: Shahrukh Khan
date: 2026-03-20
license: MIT
tags:
  - attack.stealth
  - attack.t1027.016

logsource:
  category: file_event
  product: linux

detection:
  selection_create:
    type: PATH
    nametype: CREATE
    name|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
    name|endswith:
      - '.so'
      - '.bin'
  selection_exec:
    type: EXECVE
    exe|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'

  condition: selection_create and selection_exec

falsepositives:
  - Junk-code obfuscation itself leaves no runtime trace; this proxy only flags generic write-then-execute activity in temp/shared-memory directories, which also occurs with legitimate installers, package managers, container tooling, and CI/build agents.

level: informational

T1027.016 Obfuscated Files or Information: Junk Code Insertion

title: "T1027.016 Obfuscated Files or Information: Junk Code Insertion"
id: 8828b0b0-1858-435d-8189-200cec88eb62
description: 'Detection Strategy for Junk Code Obfuscation with Suspicious Execution Patterns. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TempFilePaths, MachOPaddingThreshold, FollowOnPrivilegeEscalation.'
references:
  - https://attack.mitre.org/techniques/T1027/016
author: Shahrukh Khan
date: 2026-04-08
license: MIT
tags:
  - attack.stealth
  - attack.t1027.016

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|contains:
      - '/private/tmp/'
      - '/private/var/tmp/'
  selection_unsigned:
    ParentImage|endswith:
      - '/curl'
      - '/osascript'
  condition: selection and selection_unsigned

falsepositives:
  - Legitimate helper binaries downloaded and executed from temporary paths by installers, since Mach-O padding size and follow-on privilege escalation cannot be measured from a single process_creation record.

level: low

Related sub-techniques

Explore