| Item |
Value |
| ID |
DET0553 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1027.001 (Binary Padding)
Analytics
Windows
AN1528
Detects the creation or execution of padded binary files (e.g., large size but minimal legitimate content) followed by process execution or lateral movement from the host.
Log Sources
Mutable Elements
| Field |
Description |
| FileSizeThresholdMB |
Threshold size in MB to determine suspicious padding |
| TimeWindow |
Correlation time window between file creation and execution |
| UserContext |
Scope the detection to suspicious or non-standard user accounts |
Linux
AN1529
Detects abnormal creation of binary files with significant size that are subsequently executed or accessed by non-standard users.
Log Sources
Mutable Elements
| Field |
Description |
| FileSizeThresholdMB |
Defines how large a file must be to consider it padded |
| UserContext |
Target abnormal user behavior outside of expected automation |
| TimeWindow |
Time window for correlating file creation and execution |
macOS
AN1530
Monitors for anomalous binary files written to disk with padded size and subsequent execution by user or service context.
Log Sources
Mutable Elements
| Field |
Description |
| FileSizeThresholdMB |
Padded binary threshold for file size |
| TimeWindow |
Detection correlation window for execution after file creation |
| UserContext |
Filters for specific users or groups such as admin or service accounts |