Detect Junk Code Insertion in Microsoft Sentinel

// T1027.016 - Junk Code Insertion Detection
// Detects behavioral and artifact indicators of binaries using junk code obfuscation
// Primary signals: high entropy PE files, unusual section characteristics, sandbox evasion patterns
let SuspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "cmd.exe", "rundll32.exe", "regsvr32.exe"]);
let KnownPackerSections = dynamic([".ndata", ".MPRESS", ".petite", ".pec", "UPX0", "UPX1", ".rsrc"]);
// Signal 1: Newly created executables with suspicious section names written by Office or script interpreters
let NewExecutablesFromSuspiciousParents = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".scr"
| where InitiatingProcessFileName has_any (SuspiciousParents)
| project Timestamp, DeviceName, AccountName, FolderPath, FileName,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         SHA256, FileSize, Signal="NewExeFromSuspiciousParent";
// Signal 2: Processes with very high CPU usage and low network/file activity (junk computation loops)
let HighCPULowIO = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessVersionInfoCompanyName == "" or isnull(ProcessVersionInfoCompanyName)
| where ProcessVersionInfoProductName == "" or isnull(ProcessVersionInfoProductName)
| where not (FolderPath has_any (@"C:\Windows\System32", @"C:\Windows\SysWOW64", @"C:\Program Files", @"C:\Program Files (x86)"))
| where FileName endswith ".exe" or FileName endswith ".scr"
| project Timestamp, DeviceName, AccountName, FolderPath, FileName,
         ProcessCommandLine, InitiatingProcessFileName,
         InitiatingProcessCommandLine, SHA256, ProcessId,
         Signal="UnsignedBinaryNoVersionInfo";
// Signal 3: Script files with excessive concatenation/padding patterns indicating junk string insertion
let SuspiciousScriptExecution = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe")
| where ProcessCommandLine matches regex @"(\+\s*['"][a-zA-Z0-9]{1,3}['"]\s*){5,}"
    or ProcessCommandLine matches regex @"([Cc]hr\([0-9]+\)\s*[&\+]\s*){5,}"
    or ProcessCommandLine matches regex @"(String\.Concat|\[string\]::join).*(['"][a-zA-Z]{1,2}['"].*){10,}"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         SHA256, Signal="ExcessiveStringConcatenation";
// Signal 4: Execution from temp/user directories with no digital signature indicators
let TempDirExecution = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_any (@"\Temp\\", @"\AppData\Local\\", @"\AppData\Roaming\\", @"\Downloads\\", @"\Users\Public\")
| where FileName endswith ".exe" or FileName endswith ".scr" or FileName endswith ".com"
| where ProcessVersionInfoCompanyName == "" or isnull(ProcessVersionInfoCompanyName)
| where InitiatingProcessFileName has_any (SuspiciousParents)
| project Timestamp, DeviceName, AccountName, FolderPath, FileName,
         ProcessCommandLine, InitiatingProcessFileName,
         InitiatingProcessCommandLine, SHA256, Signal="UnsignedTempDirExecution";
// Combine all signals
NewExecutablesFromSuspiciousParents
| union HighCPULowIO
| union SuspiciousScriptExecution
| union TempDirExecution
| summarize Signals=make_set(Signal), AlertCount=count(),
           EarliestActivity=min(Timestamp), LatestActivity=max(Timestamp),
           CommandLines=make_set(ProcessCommandLine, 5),
           Hashes=make_set(SHA256, 5)
   by DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName
| extend SignalCount = array_length(Signals)
| where SignalCount >= 1
| sort by SignalCount desc, AlertCount desc