Detect Junk Code Insertion in IBM QRadar
Adversaries may insert junk code or dead code into malware to obfuscate its functionality, hinder static analysis, and evade signature-based detections. Junk code includes NOP (No-Operation) sleds, dummy API calls, excessive mathematical operations, infinite loops that are never reached, and random garbage instructions interspersed between legitimate code. Unlike Binary Padding (T1027.001), which changes file size/hash, junk code insertion specifically targets analyst workflow and automated analysis engines. Real-world actors including Maze ransomware, FIN7, Gamaredon Group, APT32, Kimsuky, and StrelaStealer have employed this technique.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.016 Junk Code Insertion
- Canonical reference
- https://attack.mitre.org/techniques/T1027/016/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
sourceip AS SourceIP,
"username" AS Username,
"hostname" AS Hostname,
"FileName" AS ProcessName,
"CommandLine" AS CommandLine,
"ParentProcessName" AS ParentProcess,
"FilePath" AS FilePath,
CATEGORYNAME(category) AS Category,
logsourcetypeid AS LogSourceType,
COUNT(*) AS SignalCount,
ARRAY_AGG(QIDNAME(qid)) AS SignalTypes
FROM events
WHERE
LOGSOURCETYPEID IN (12, 396)
AND starttime > NOW() - 86400 SECONDS
AND (
-- Signal 1: Executable created by Office/script interpreter (Sysmon EID 11)
(qid = (SELECT qid FROM QidMap WHERE QIDNAME = 'SysmonFileCreate') AND
("TargetFilename" ILIKE '%.exe' OR "TargetFilename" ILIKE '%.dll' OR "TargetFilename" ILIKE '%.scr') AND
("Image" ILIKE '%\\winword.exe' OR "Image" ILIKE '%\\excel.exe' OR "Image" ILIKE '%\\powerpnt.exe'
OR "Image" ILIKE '%\\outlook.exe' OR "Image" ILIKE '%\\mshta.exe' OR "Image" ILIKE '%\\wscript.exe'
OR "Image" ILIKE '%\\cscript.exe' OR "Image" ILIKE '%\\cmd.exe' OR "Image" ILIKE '%\\rundll32.exe'))
OR
-- Signal 2: Unsigned binary executing from temp/writable dirs spawned by suspicious parent (Sysmon EID 1)
(qid = (SELECT qid FROM QidMap WHERE QIDNAME = 'SysmonProcessCreate') AND
("Image" ILIKE '%\\Temp\\%' OR "Image" ILIKE '%\\AppData\\Local\\%' OR "Image" ILIKE '%\\AppData\\Roaming\\%'
OR "Image" ILIKE '%\\Downloads\\%' OR "Image" ILIKE '%\\Users\\Public\\%') AND
("Image" ILIKE '%.exe' OR "Image" ILIKE '%.scr' OR "Image" ILIKE '%.com') AND
("ParentImage" ILIKE '%\\winword.exe' OR "ParentImage" ILIKE '%\\excel.exe' OR "ParentImage" ILIKE '%\\mshta.exe'
OR "ParentImage" ILIKE '%\\wscript.exe' OR "ParentImage" ILIKE '%\\cscript.exe'))
OR
-- Signal 3: Script interpreter with excessive string concat patterns (Sysmon EID 1)
(qid = (SELECT qid FROM QidMap WHERE QIDNAME = 'SysmonProcessCreate') AND
("Image" ILIKE '%\\powershell.exe' OR "Image" ILIKE '%\\pwsh.exe' OR "Image" ILIKE '%\\wscript.exe'
OR "Image" ILIKE '%\\cscript.exe' OR "Image" ILIKE '%\\cmd.exe') AND
(LOWER("CommandLine") MATCHES '.*chr\\(\\d+\\)(\\s*[&+]\\s*chr\\(\\d+\\)){4,}.*'
OR LOWER("CommandLine") MATCHES '.*(\\+\\s*[a-z0-9]{1,3}\\s*){5,}.*'
OR LOWER("CommandLine") MATCHES '.*(string\\.concat|\\[string\\]::join).*'))
)
GROUP BY
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss'), sourceip, "username", "hostname",
"FileName", "CommandLine", "ParentProcessName", "FilePath", CATEGORYNAME(category), logsourcetypeid
HAVING COUNT(*) >= 1
ORDER BY SignalCount DESC, EventTime DESC
LIMIT 500Detects T1027.016 Junk Code Insertion indicators in QRadar using Sysmon event data. Correlates three behavioral signals: executable file creation by Office and script interpreter parents (Sysmon EID 11), unsigned binary execution from user-writable directories with suspicious parent processes (Sysmon EID 1), and script interpreter command lines containing excessive string concatenation patterns characteristic of junk code obfuscation (Sysmon EID 1).
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software deployment tools (SCCM, PDQ Deploy) that write executables to temp directories
- Build pipelines or CI agents running on Windows workstations that compile and execute binaries from temp locations
- IT automation scripts using PowerShell with extensive string operations for configuration tasks
- Scripted application installers that use mshta.exe or wscript.exe as part of their setup process
Other platforms for T1027.016
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Script with Excessive String Concatenation Junk Code
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing excessive variable concatenation. PowerShell ScriptBlock Log Event ID 4104 will show full script with dead variable assignments and Invoke-Expression. The final executed command 'whoami' will also appear in script block logs.
- Test 2VBScript with Dead Code Padding (chr() Concatenation Pattern)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junktest.vbs (created by cmd.exe). Sysmon Event ID 1: Process Create for cscript.exe executing junktest.vbs. Sysmon Event ID 1: Child process cmd.exe spawned by cscript.exe with whoami command. Sysmon Event ID 11: File Create for %TEMP%\vbsout.txt.
- Test 3Compile and Execute Binary with NOP Sled Simulation via Inline Assembly
Expected signal: Sysmon Event ID 1: PowerShell.exe process with Add-Type command. Sysmon Event ID 11: File Create for %TEMP%\junkcode_test.exe compiled by csc.exe (invoked by Add-Type). Sysmon Event ID 1: Execution of junkcode_test.exe from %TEMP% directory. PowerShell ScriptBlock Log Event ID 4104 showing the source code with NOP-equivalent patterns.
- Test 4Batch File with Dead Code Branches and Junk Variable Inflation
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junkbatch.bat. Sysmon Event ID 1: cmd.exe executing junkbatch.bat from %TEMP%. Sysmon Event ID 1: Child cmd.exe process executing whoami. Sysmon Event ID 11: File Create for %TEMP%\batchout.txt. Security Event ID 4688 (if process creation auditing enabled) for all cmd.exe instances.
References (12)
- https://attack.mitre.org/techniques/T1027/016/
- https://cyberpedia.reasonlabs.com/EN/dead%20code%20insertion.html
- https://cyberpedia.reasonlabs.com/EN/junk%20code.html
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/maze-ransomware-no-promised-decryption-key-after-ransom-payment/
- https://www.welivesecurity.com/2016/10/25/lifting-lid-sednit-closer-look-group/
- https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
- https://www.cybereason.com/blog/operation-cobalt-kitty-apt
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Unlock Pro Content
Get the full detection package for T1027.016 including response playbook, investigation guide, and atomic red team tests.