Detect Junk Code Insertion in Elastic Security
Adversaries may insert junk code or dead code into malware to obfuscate its functionality, hinder static analysis, and evade signature-based detections. Junk code includes NOP (No-Operation) sleds, dummy API calls, excessive mathematical operations, infinite loops that are never reached, and random garbage instructions interspersed between legitimate code. Unlike Binary Padding (T1027.001), which changes file size/hash, junk code insertion specifically targets analyst workflow and automated analysis engines. Real-world actors including Maze ransomware, FIN7, Gamaredon Group, APT32, Kimsuky, and StrelaStealer have employed this technique.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.016 Junk Code Insertion
- Canonical reference
- https://attack.mitre.org/techniques/T1027/016/
Elastic Detection Query
sequence by host.name, user.name with maxspan=1h
[file where event.action == "creation" and
(file.extension == "exe" or file.extension == "dll" or file.extension == "scr") and
process.name in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mshta.exe","wscript.exe","cscript.exe","cmd.exe","rundll32.exe","regsvr32.exe")]
[process where event.type == "start" and
(process.name == "powershell.exe" or process.name == "pwsh.exe" or process.name == "wscript.exe" or process.name == "cscript.exe" or process.name == "cmd.exe") and
(process.args : "*chr(*" or process.args : "*String.Concat*" or process.args : "*[string]::join*")]
pipe
[process where event.type == "start" and
(process.executable : "*\\Temp\\*" or process.executable : "*\\AppData\\Local\\*" or process.executable : "*\\AppData\\Roaming\\*" or process.executable : "*\\Downloads\\*" or process.executable : "*\\Users\\Public\\*") and
(process.code_signature.exists == false or process.code_signature.trusted == false) and
process.parent.name in~ ("winword.exe","excel.exe","powerpnt.exe","mshta.exe","wscript.exe","cscript.exe")]Detects T1027.016 Junk Code Insertion via three correlated signals: (1) executable files written by Office/script interpreter processes, (2) script processes using excessive string concatenation patterns indicative of junk code obfuscation, and (3) unsigned binaries executing from temp/user writable directories spawned by suspicious parents. Uses EQL sequence correlation to chain signals within a 1-hour window per host and user.
Data Sources
Required Tables
False Positives & Tuning
- Software installers and update mechanisms that unpack executables to temp directories using legitimate scripting
- Developer tools like MSBuild, Roslyn, or webpack that perform heavy string concatenation in build scripts
- Legitimate automation scripts using PowerShell string operations for configuration management (Ansible, Chef, DSC)
- Security tools performing in-memory compilation or dynamic code generation (e.g., Pester test framework)
Other platforms for T1027.016
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Script with Excessive String Concatenation Junk Code
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing excessive variable concatenation. PowerShell ScriptBlock Log Event ID 4104 will show full script with dead variable assignments and Invoke-Expression. The final executed command 'whoami' will also appear in script block logs.
- Test 2VBScript with Dead Code Padding (chr() Concatenation Pattern)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junktest.vbs (created by cmd.exe). Sysmon Event ID 1: Process Create for cscript.exe executing junktest.vbs. Sysmon Event ID 1: Child process cmd.exe spawned by cscript.exe with whoami command. Sysmon Event ID 11: File Create for %TEMP%\vbsout.txt.
- Test 3Compile and Execute Binary with NOP Sled Simulation via Inline Assembly
Expected signal: Sysmon Event ID 1: PowerShell.exe process with Add-Type command. Sysmon Event ID 11: File Create for %TEMP%\junkcode_test.exe compiled by csc.exe (invoked by Add-Type). Sysmon Event ID 1: Execution of junkcode_test.exe from %TEMP% directory. PowerShell ScriptBlock Log Event ID 4104 showing the source code with NOP-equivalent patterns.
- Test 4Batch File with Dead Code Branches and Junk Variable Inflation
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junkbatch.bat. Sysmon Event ID 1: cmd.exe executing junkbatch.bat from %TEMP%. Sysmon Event ID 1: Child cmd.exe process executing whoami. Sysmon Event ID 11: File Create for %TEMP%\batchout.txt. Security Event ID 4688 (if process creation auditing enabled) for all cmd.exe instances.
References (12)
- https://attack.mitre.org/techniques/T1027/016/
- https://cyberpedia.reasonlabs.com/EN/dead%20code%20insertion.html
- https://cyberpedia.reasonlabs.com/EN/junk%20code.html
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/maze-ransomware-no-promised-decryption-key-after-ransom-payment/
- https://www.welivesecurity.com/2016/10/25/lifting-lid-sednit-closer-look-group/
- https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
- https://www.cybereason.com/blog/operation-cobalt-kitty-apt
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Unlock Pro Content
Get the full detection package for T1027.016 including response playbook, investigation guide, and atomic red team tests.