Detect Junk Code Insertion in Sumo Logic CSE

// T1027.016 Junk Code Insertion - Sumo Logic CSE Detection
// Signal 1: Executable created by suspicious parent process
(_sourceCategory="*sysmon*" OR _sourceCategory="*windows*")
| where EventID = "11"
| where (TargetFilename endswith ".exe" OR TargetFilename endswith ".dll" OR TargetFilename endswith ".scr")
| where (Image matches "*\\winword.exe" OR Image matches "*\\excel.exe" OR Image matches "*\\powerpnt.exe"
         OR Image matches "*\\outlook.exe" OR Image matches "*\\mshta.exe" OR Image matches "*\\wscript.exe"
         OR Image matches "*\\cscript.exe" OR Image matches "*\\cmd.exe" OR Image matches "*\\rundll32.exe"
         OR Image matches "*\\regsvr32.exe")
| fields _time, Computer, User, Image, TargetFilename, Hashes
| withtime _time
| count_distinct(TargetFilename) as FileCount, values(Hashes) as Hashes by Computer, User, Image
| where FileCount >= 1
| eval Signal = "NewExeFromSuspiciousParent"

// Signal 2: Script process with junk string concatenation patterns
// Run separately and union
(_sourceCategory="*sysmon*" OR _sourceCategory="*windows*")
| where EventID = "1"
| where (Image matches "*\\powershell.exe" OR Image matches "*\\pwsh.exe"
         OR Image matches "*\\wscript.exe" OR Image matches "*\\cscript.exe" OR Image matches "*\\cmd.exe")
| where (CommandLine matches /(?i)(chr\(\d+\)(\s*[&+]\s*chr\(\d+\)){4,})/
         OR CommandLine matches /(\+\s*['"]{1}[a-zA-Z0-9]{1,3}['"]{1}\s*){5,}/
         OR CommandLine matches /(?i)(string\.concat|\[string\]::join)/)
| fields _time, Computer, User, Image, CommandLine, ParentImage, Hashes
| eval Signal = "ExcessiveStringConcatenation"
| count by Computer, User, Image, Signal

// Signal 3: Unsigned binary in temp/writable dir spawned by suspicious parent
(_sourceCategory="*sysmon*" OR _sourceCategory="*windows*")
| where EventID = "1"
| where (Image matches "*\\Temp\\*" OR Image matches "*\\AppData\\Local\\*"
         OR Image matches "*\\AppData\\Roaming\\*" OR Image matches "*\\Downloads\\*"
         OR Image matches "*\\Users\\Public\\*")
| where (Image matches "*.exe" OR Image matches "*.scr" OR Image matches "*.com")
| where (ParentImage matches "*\\winword.exe" OR ParentImage matches "*\\excel.exe"
         OR ParentImage matches "*\\powerpnt.exe" OR ParentImage matches "*\\mshta.exe"
         OR ParentImage matches "*\\wscript.exe" OR ParentImage matches "*\\cscript.exe")
| fields _time, Computer, User, Image, CommandLine, ParentImage, Hashes
| eval Signal = "UnsignedTempDirExecution"
| count by Computer, User, Image, Signal

// Aggregate and score across signals
| append [signals combined above via union in real deployment]
| stats count as AlertCount, values(Signal) as Signals, min(_time) as EarliestActivity,
        max(_time) as LatestActivity, values(CommandLine) as CommandLines, values(Hashes) as FileHashes
  by Computer, User, Image
| eval SignalCount = arraylength(Signals)
| where SignalCount >= 1
| eval RiskScore = if(SignalCount >= 3, "High", if(SignalCount == 2, "Medium", "Low"))
| sort by SignalCount desc, AlertCount desc