Binary Padding

let LargePEThresholdMB = 50;
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".sys"
| where FileSize > (LargePEThresholdMB * 1024 * 1024)
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, SHA256
) on DeviceName
| where FolderPath !startswith "C:\\Windows\\"
    and FolderPath !startswith "C:\\Program Files\\"
    and FolderPath !startswith "C:\\Program Files (x86)\\"
| project Timestamp, DeviceName, FolderPath, FileName, FileSize,
         InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| extend FileSizeMB = round(toreal(FileSize) / (1024*1024), 1)
| sort by FileSizeMB desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.sys")
  NOT (TargetFilename="C:\\Windows\\*" OR TargetFilename="C:\\Program Files\\*" OR TargetFilename="C:\\Program Files (x86)\\*")
| eval FileSizeBytes=coalesce(file_size, 0)
| eval FileSizeMB=round(FileSizeBytes/1048576, 1)
| where FileSizeMB > 50
| table _time, host, User, TargetFilename, FileSizeMB, Image, CommandLine
| sort - FileSizeMB

file where event.action == "creation" and
  file.extension in~ ("exe", "dll", "sys") and
  file.size > 52428800 and
  not file.path : (
    "C:\\Windows\\*",
    "C:\\Program Files\\*",
    "C:\\Program Files (x86)\\*"
  )

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  username AS UserName,
  "TargetFilename",
  LONG("FileSize") AS FileSizeBytes,
  LONG("FileSize") / 1048576 AS FileSizeMB,
  "Image" AS WritingProcess,
  "CommandLine",
  "Hashes"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Sysmon%'
  AND QIDNAME(qid) ILIKE '%File Create%'
  AND (
    "TargetFilename" ILIKE '%.exe'
    OR "TargetFilename" ILIKE '%.dll'
    OR "TargetFilename" ILIKE '%.sys'
  )
  AND LONG("FileSize") > 52428800
  AND "TargetFilename" NOT ILIKE 'C:\\Windows\\%'
  AND "TargetFilename" NOT ILIKE 'C:\\Program Files\\%'
  AND "TargetFilename" NOT ILIKE 'C:\\Program Files (x86)\\%'
  AND devicetime > DATEADD('hour', -24, NOW())
ORDER BY FileSizeBytes DESC
LIMIT 500

_sourceCategory=*windows*sysmon* OR _sourceCategory=*sysmon*
| where EventCode == "11"
| where TargetFilename matches /\.(exe|dll|sys)$/i
| where !(TargetFilename matches /^C:\\Windows\\/i)
    and !(TargetFilename matches /^C:\\Program Files\\/i)
    and !(TargetFilename matches /^C:\\Program Files \(x86\)\\/i)
| where isNumeric(file_size)
| eval FileSizeBytes = toLong(file_size)
| eval FileSizeMB = round(FileSizeBytes / 1048576, 1)
| where FileSizeMB > 50
| fields _messageTime, Computer, User, TargetFilename, FileSizeMB, Image, CommandLine, Hashes
| sort by FileSizeMB desc

rule binary_padding_large_pe_t1027_001 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects PE files larger than 50MB created outside trusted Windows system directories, indicating potential binary padding (T1027.001). Used by APT29, Kimsuky, Emotet, QakBot, Black Basta, and Akira to change file hashes and evade AV file-size limits."
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1027.001"
    mitre_attack_technique_name = "Obfuscated Files or Information: Binary Padding"
    reference = "https://attack.mitre.org/techniques/T1027/001/"
    severity = "MEDIUM"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    (
      re.regex($e.target.file.full_path, `(?i)\.exe$`) or
      re.regex($e.target.file.full_path, `(?i)\.dll$`) or
      re.regex($e.target.file.full_path, `(?i)\.sys$`)
    )
    not re.regex($e.target.file.full_path, `(?i)^C:\\Windows\\`)
    not re.regex($e.target.file.full_path, `(?i)^C:\\Program Files\\`)
    not re.regex($e.target.file.full_path, `(?i)^C:\\Program Files \(x86\)\\`)
    $e.target.file.size > 52428800

  condition:
    $e
}

#event_simpleName = "NewExecutableWritten"
| TargetFileName = /\.(exe|dll|sys)$/i
| TargetFileName != /^C:\\Windows\\/i
| TargetFileName != /^C:\\Program Files\\/i
| TargetFileName != /^C:\\Program Files \(x86\)\\/i
| where(FileSize > 52428800)
| eval(FileSizeMB := round(FileSize / 1048576, 1))
| select([ComputerName, UserName, TargetFileName, FileSize, FileSizeMB, ImageFileName, SHA256HashData, CommandLine, ParentBaseFileName])
| sort(FileSizeMB, order=desc)