CmdID

CmdID / Techniques / T1027

T1027.001 Obfuscated Files or Information: Binary Padding

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. MITRE ATT&CK

1 program on CmdID 1 Sigma rule T1027.001 on attack.mitre.org

Part of

MITRE ATT&CK
T1027Obfuscated Files or Information

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
ddits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highBinary Padding - MacOSIgor Fits, Mikhail Larin, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Generate a file with a specific number of random bytes by using kernel random driver on the page for dd

dd bs=100 count=1 if=/dev/urandom of=path/to/random_fileIdentify

An example is here when CmdID’s reading of it names T1027.001: a Sigma rule it trips is tagged with it, or its abuse is documented as it.