padded

Nobody has claimed this yet.

## Rule name

`padded`

## Summary

Detect files which contain padding with extraneous data such as zeros or random bytes. Sometimes used to evade antivirus engines that will not scan files above a set size limit.

Detecting zeros is easy, but not random bytes. One idea is to detect random paddings by looking for an unusual amount of zeros with regular expressions.

## Possible test samples

Publicly available samples that may contain the capability this rule should detect (MD5 hashes):
- 3a71311ac69f26e478e2d80541e9a412 (capa is not able to run on this sample at the moment, this is caused by a bug on vivisect: https://github.com/vivisect/vivisect/issues/391)

## References

Links or references to additional information on the capability (can also be included in the rule):

- https://attack.mitre.org/techniques/T1027/001/

## Namespace

Proposed namespace: `anti-analysis/padding`. More details in https://github.com/fireeye/capa-rules/blob/master/doc/format.md#rule-namespace

## att&ck

`aka.mitre.att&ck.t1027.001`

Start with the rule format documentation linked in the issue and review the proposed namespace anti-analysis/padding. Investigate the referenced sample by its MD5 and the vivisect issue blocking capa analysis, then determine how padding with zeros or random bytes can be identified. Done means a valid padded rule detects the intended capability and includes the T1027.001 mapping.

Written by the indexing model from the issue text.