MITRE ATT&CK technique · stealth

`T1027.016` Junk Code Insertion

Sub-technique of T1027 Obfuscated Files or Information

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT-C-36

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.