An analyst finds that a malicious program contains the instructions add 10, eax followed by sub 10, eax. What technique was the attacker likely using?

Ghostwriting is a malware obfuscation technique where attackers insert semantically neutral instruction sequences - code that executes but produces no net effect on program state - to change the binary's byte pattern and evade signature-based detection. The add 10, eax / sub 10, eax pair is a textbook example because it modifies then immediately restores the register value, leaving execution state unchanged while altering the malware's hash and byte signature. This preserves the malicious payload's functionality while defeating static pattern matching used by antivirus tools.

Code signing uses cryptographic certificates from a trusted certificate authority to verify software authenticity and integrity, and is not a technique for inserting obfuscating instructions.

Compile After Delivery involves distributing source code or scripts to be compiled on the victim system to evade static analysis of pre-compiled binaries, not inserting dead assembly instructions.

Living Off the Land involves leveraging legitimate pre-installed system tools such as PowerShell or certutil to carry out malicious actions, rather than manipulating low-level assembly instructions.