Detect Junk Code Insertion in CrowdStrike LogScale
Adversaries may insert junk code or dead code into malware to obfuscate its functionality, hinder static analysis, and evade signature-based detections. Junk code includes NOP (No-Operation) sleds, dummy API calls, excessive mathematical operations, infinite loops that are never reached, and random garbage instructions interspersed between legitimate code. Unlike Binary Padding (T1027.001), which changes file size/hash, junk code insertion specifically targets analyst workflow and automated analysis engines. Real-world actors including Maze ransomware, FIN7, Gamaredon Group, APT32, Kimsuky, and StrelaStealer have employed this technique.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.016 Junk Code Insertion
- Canonical reference
- https://attack.mitre.org/techniques/T1027/016/
LogScale Detection Query
// T1027.016 Junk Code Insertion - CrowdStrike LogScale (Falcon)
// Signal 1: Executable written to disk by Office/script interpreter parent
#event_simpleName = WriteFile
| CommandLine = *
| ParentBaseFileName in ["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
"mshta.exe", "wscript.exe", "cscript.exe", "cmd.exe",
"rundll32.exe", "regsvr32.exe"]
| TargetFileName = /(?\.exe$|\.dll$|\.scr$)/i
| eval Signal = "NewExeFromSuspiciousParent"
| table([_timems, ComputerName, UserName, ParentBaseFileName, TargetFileName, SHA256HashData, Signal])
// Signal 2: Process launched from temp/user-writable path with suspicious parent
| union
[
#event_simpleName = ProcessRollup2
| ImageFileName = /(?i)(\\Temp\\|\\AppData\\Local\\|\\AppData\\Roaming\\|\\Downloads\\|\\Users\\Public\\)/
| ImageFileName = /(?i)(\.(exe|scr|com))$/
| ParentBaseFileName in ["winword.exe", "excel.exe", "powerpnt.exe",
"mshta.exe", "wscript.exe", "cscript.exe"]
| not ImageFileName = /(?i)C:\\Windows\\(System32|SysWOW64)\\/
| eval Signal = "UnsignedTempDirExecution"
| table([_timems, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, Signal])
]
// Signal 3: Script interpreter with junk string concatenation patterns
| union
[
#event_simpleName = ProcessRollup2
| BaseFileName in ["powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe"]
| CommandLine = /(?i)(chr\(\d+\)(\s*[&+]\s*chr\(\d+\)){4,})|(\+\s*['"][a-zA-Z0-9]{1,3}['"]\s*){5,}|(string\.concat|\[string\]::join)/
| eval Signal = "ExcessiveStringConcatenation"
| table([_timems, ComputerName, UserName, BaseFileName, CommandLine, ParentBaseFileName, SHA256HashData, Signal])
]
// Aggregate signals per host/user/process
| groupBy([ComputerName, UserName, ImageFileName], function=[
count() as AlertCount,
collect(Signal) as Signals,
min(_timems) as EarliestActivity,
max(_timems) as LatestActivity,
collect(CommandLine, limit=5) as CommandLines,
collect(SHA256HashData, limit=5) as Hashes
])
| eval SignalCount = array_length(Signals)
| where SignalCount >= 1
| eval RiskScore = case(
SignalCount >= 3, "High",
SignalCount == 2, "Medium",
true(), "Low"
)
| sort(field=SignalCount, order=desc)CrowdStrike LogScale (Falcon) detection for T1027.016 Junk Code Insertion using native Falcon telemetry events. Correlates three signals: (1) WriteFile events showing executables written by Office or script interpreter processes, (2) ProcessRollup2 events showing binary execution from temp/user-writable directories with suspicious parent lineage, and (3) ProcessRollup2 events for script interpreters with command lines matching excessive string concatenation patterns used in junk code obfuscated scripts. Results are aggregated per host/user/binary with risk scoring.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor itself performing real-time monitoring may trigger WriteFile detections for quarantined file copies
- Software packaging tools (WiX, NSIS, Inno Setup) that extract and execute component binaries from temp directories
- Automated testing frameworks (Selenium, Playwright) invoked from Office-based test orchestration scripts
- Enterprise software with legitimate macro-driven deployment workflows approved by IT security
Other platforms for T1027.016
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Script with Excessive String Concatenation Junk Code
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing excessive variable concatenation. PowerShell ScriptBlock Log Event ID 4104 will show full script with dead variable assignments and Invoke-Expression. The final executed command 'whoami' will also appear in script block logs.
- Test 2VBScript with Dead Code Padding (chr() Concatenation Pattern)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junktest.vbs (created by cmd.exe). Sysmon Event ID 1: Process Create for cscript.exe executing junktest.vbs. Sysmon Event ID 1: Child process cmd.exe spawned by cscript.exe with whoami command. Sysmon Event ID 11: File Create for %TEMP%\vbsout.txt.
- Test 3Compile and Execute Binary with NOP Sled Simulation via Inline Assembly
Expected signal: Sysmon Event ID 1: PowerShell.exe process with Add-Type command. Sysmon Event ID 11: File Create for %TEMP%\junkcode_test.exe compiled by csc.exe (invoked by Add-Type). Sysmon Event ID 1: Execution of junkcode_test.exe from %TEMP% directory. PowerShell ScriptBlock Log Event ID 4104 showing the source code with NOP-equivalent patterns.
- Test 4Batch File with Dead Code Branches and Junk Variable Inflation
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junkbatch.bat. Sysmon Event ID 1: cmd.exe executing junkbatch.bat from %TEMP%. Sysmon Event ID 1: Child cmd.exe process executing whoami. Sysmon Event ID 11: File Create for %TEMP%\batchout.txt. Security Event ID 4688 (if process creation auditing enabled) for all cmd.exe instances.
References (12)
- https://attack.mitre.org/techniques/T1027/016/
- https://cyberpedia.reasonlabs.com/EN/dead%20code%20insertion.html
- https://cyberpedia.reasonlabs.com/EN/junk%20code.html
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/maze-ransomware-no-promised-decryption-key-after-ransom-payment/
- https://www.welivesecurity.com/2016/10/25/lifting-lid-sednit-closer-look-group/
- https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
- https://www.cybereason.com/blog/operation-cobalt-kitty-apt
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Unlock Pro Content
Get the full detection package for T1027.016 including response playbook, investigation guide, and atomic red team tests.