What MITRE ATT&CK T1027.001: Binary Padding (Enterprise Tactic TA0005 - Defense Evasion) requires
MITRE ATT&CK T1027.001 (Binary Padding) is an Enterprise Defense Evasion sub-technique of T1027 (Obfuscated Files or Information). Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures. Affected platforms: Linux, macOS, Windows. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-03, CM-02, CM-06, CM-07, SI-02, SI-03, SI-04, SI-07.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1027/001/
SHA-256 integrity: 85e57acd2f92cbbde1424f43a4f45b7fc97ef5083fa5e79613eab896c0ad7eaf
Primary Citations — 6 traced to source
- MITRE ATT&CK Technique T1027.001: Binary Padding (https://attack.mitre.org/techniques/T1027/001/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1027-001-binary-padding.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1027-001-binary-padding.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1027-001-binary-padding
- Back to registry: Browse all 10,085 compliance nodes