Detect Junk Code Insertion in Splunk
Adversaries may insert junk code or dead code into malware to obfuscate its functionality, hinder static analysis, and evade signature-based detections. Junk code includes NOP (No-Operation) sleds, dummy API calls, excessive mathematical operations, infinite loops that are never reached, and random garbage instructions interspersed between legitimate code. Unlike Binary Padding (T1027.001), which changes file size/hash, junk code insertion specifically targets analyst workflow and automated analysis engines. Real-world actors including Maze ransomware, FIN7, Gamaredon Group, APT32, Kimsuky, and StrelaStealer have employed this technique.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.016 Junk Code Insertion
- Canonical reference
- https://attack.mitre.org/techniques/T1027/016/
SPL Detection Query
| union
[
search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.scr")
(Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe"
OR Image="*\\outlook.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe"
OR Image="*\\cscript.exe" OR Image="*\\cmd.exe" OR Image="*\\rundll32.exe")
| eval Signal="NewExeFromSuspiciousParent"
| eval TargetPath=TargetFilename
| table _time, host, User, Image, TargetFilename, Hashes, Signal
]
[
search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\Temp\\*" OR Image="*\\AppData\\Local\\*" OR Image="*\\AppData\\Roaming\\*"
OR Image="*\\Downloads\\*" OR Image="*\\Users\\Public\\*")
(Image="*.exe" OR Image="*.scr" OR Image="*.com")
(ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe"
OR ParentImage="*\\mshta.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe")
| eval Signal="UnsignedTempDirExecution"
| eval TargetPath=Image
| table _time, host, User, Image, CommandLine, ParentImage, Hashes, Signal
]
[
search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe"
OR Image="*\\cscript.exe" OR Image="*\\cmd.exe")
| eval cmdlow=lower(CommandLine)
| where match(cmdlow, "(chr\\(\\d+\\)(\\s*[&+]\\s*chr\\(\\d+\\)){4,})")
OR match(cmdlow, "(\\+\\s*['\"][a-zA-Z0-9]{1,3}['\"]\\s*){5,}")
OR match(cmdlow, "(string\\.concat|\\[string\\]::join)")
| eval Signal="ExcessiveStringConcatenation"
| eval TargetPath=Image
| table _time, host, User, Image, CommandLine, ParentImage, Hashes, Signal
]
| stats values(Signal) as Signals, count as AlertCount,
earliest(_time) as EarliestActivity, latest(_time) as LatestActivity,
values(CommandLine) as CommandLines, values(Hashes) as FileHashes
by host, User, Image
| eval SignalCount=mvcount(Signals)
| where SignalCount >= 1
| eval RiskScore=case(
SignalCount >= 3, "High",
SignalCount == 2, "Medium",
SignalCount == 1, "Low"
)
| table _time, host, User, Image, Signals, SignalCount, RiskScore, AlertCount, EarliestActivity, LatestActivity, CommandLines, FileHashes
| sort - SignalCount AlertCountDetects behavioral indicators of junk code insertion using Sysmon logs. Three signal types are unioned: (1) executable files created by Office/script interpreter parents (Sysmon Event 11), (2) unsigned executables running from user-writable temp/appdata directories spawned by suspicious parents (Sysmon Event 1), and (3) scripts with excessive string concatenation patterns characteristic of Kimsuky and FIN7 obfuscation (Sysmon Event 1). Results are aggregated by host/user/process with a risk score based on how many signal types are triggered.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate software installers that extract temporary executables to %TEMP% directories during installation (e.g., NSIS, Inno Setup installers)
- Developer tools and build systems (MSBuild, Roslyn compilers) generating intermediate binaries without version metadata in temp directories
- Scripting automation tools using heavy string concatenation for legitimate data manipulation or template generation
- Third-party software lacking version information metadata (many open-source or legacy applications omit this field)
- Security testing tools and penetration testing frameworks that intentionally lack signatures
Other platforms for T1027.016
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Script with Excessive String Concatenation Junk Code
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing excessive variable concatenation. PowerShell ScriptBlock Log Event ID 4104 will show full script with dead variable assignments and Invoke-Expression. The final executed command 'whoami' will also appear in script block logs.
- Test 2VBScript with Dead Code Padding (chr() Concatenation Pattern)
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junktest.vbs (created by cmd.exe). Sysmon Event ID 1: Process Create for cscript.exe executing junktest.vbs. Sysmon Event ID 1: Child process cmd.exe spawned by cscript.exe with whoami command. Sysmon Event ID 11: File Create for %TEMP%\vbsout.txt.
- Test 3Compile and Execute Binary with NOP Sled Simulation via Inline Assembly
Expected signal: Sysmon Event ID 1: PowerShell.exe process with Add-Type command. Sysmon Event ID 11: File Create for %TEMP%\junkcode_test.exe compiled by csc.exe (invoked by Add-Type). Sysmon Event ID 1: Execution of junkcode_test.exe from %TEMP% directory. PowerShell ScriptBlock Log Event ID 4104 showing the source code with NOP-equivalent patterns.
- Test 4Batch File with Dead Code Branches and Junk Variable Inflation
Expected signal: Sysmon Event ID 11: File Create for %TEMP%\junkbatch.bat. Sysmon Event ID 1: cmd.exe executing junkbatch.bat from %TEMP%. Sysmon Event ID 1: Child cmd.exe process executing whoami. Sysmon Event ID 11: File Create for %TEMP%\batchout.txt. Security Event ID 4688 (if process creation auditing enabled) for all cmd.exe instances.
References (12)
- https://attack.mitre.org/techniques/T1027/016/
- https://cyberpedia.reasonlabs.com/EN/dead%20code%20insertion.html
- https://cyberpedia.reasonlabs.com/EN/junk%20code.html
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/maze-ransomware-no-promised-decryption-key-after-ransom-payment/
- https://www.welivesecurity.com/2016/10/25/lifting-lid-sednit-closer-look-group/
- https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
- https://www.cybereason.com/blog/operation-cobalt-kitty-apt
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027/T1027.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Unlock Pro Content
Get the full detection package for T1027.016 including response playbook, investigation guide, and atomic red team tests.