T1027.016No distinct observable

Junk Code Insertion

StealthLinux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The two properties that make this technique junk-code insertion rather than generic staging — opcode composition and file size — are carried by no field in any log source the brief supplies. AN0913's knobs are NOPThreshold ('high proportion of 0x90 opcodes indicating junk code') and ExecutableSizeThreshold ('size range for abnormally large binaries relative to their runtime behavior'), and its three log sources are Sysmon EventID 11 (file_event: TargetFilename, Image, CreationUtcTime), EventID 10 (process_access: SourceImage, TargetImage, GrantedAccess, CallTrace) and EventID 1 (process_creation: Image, CommandLine, ParentImage, OriginalFileName, Hashes, IntegrityLevel). Not one of them reports a byte count, a section size or anything about instruction content, and Hashes is a digest — it identifies a file, it does not describe its padding. […]

Covered instead by T1027, T1027.001, T1027.002, T1027.014, T1027.015, T1055.

What the technique is

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with Compression or Software Packing. No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them. The use of junk / dead code insertion is distinct from Binary Padding because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.

Read it on attack.mitre.org

What MITRE says you would watch

AN0913
Detects the presence of executables with high NOP padding, unusually large binary size for their function, and follow-on execution or memory injection from such files, especially when originating from temp or user-space paths.
AN0914
Detects ELF binaries written to disk that demonstrate anomalous file size or entropy, quickly followed by execution or memory region writes into remote processes (e.g., using ptrace).
AN0915
Identifies Mach-O binaries dropped into temporary directories with abnormally high binary size or padding patterns, followed by privilege escalation, exec, or memory mapping of other processes.