DJoinv07publicxorencryptiondrmist

Hunt Hypothesis

This hypothesis targets the execution of the DJoin v0.7 public XOR encryption driver, a known component often leveraged by threat actors to facilitate credential dumping or lateral movement within Active Directory environments. Proactively hunting for this specific driver helps the SOC identify early-stage post-compromise activities that may otherwise go unnoticed due to its low severity classification and potential use in living-off-the-land techniques.

YARA Rule

rule DJoinv07publicxorencryptiondrmist
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C6 05 [2] 40 00 00 [8] 00 [4] 00 [5] 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy Java-based application server (e.g., Tomcat or JBoss) is performing routine key exchange or session initialization using a custom, non-standard XOR-based obfuscation layer for public data packets. The YARA rule matches the specific byte pattern of the XOR key or the encrypted payload structure during normal HTTP/HTTPS traffic processing.

  • Filter/Exclusion: Exclude processes where the parent process is java.exe or jre.exe and the file path contains tomcat, jboss, or wildfly. Additionally, exclude if the network destination port is 8080 or 443 and the source process is a known web server binary.

• Scenario: An enterprise backup solution (e.g., Veeam, Commvault, or Acronis) is creating a snapshot or incremental backup of a database file (e.g., *.mdf or *.ndf) that contains a specific header signature matching the “DJoinv07” XOR pattern due to the database’s internal page structure or a custom encryption module used by the backup agent.

  • Filter/Exclusion: Exclude if the process name is vssadmin.exe, wbadmin.exe, or the specific backup agent binary (e.g., veeamagent.exe, commvaultagent.exe). Also, exclude file paths under standard backup directories like C:\Program Files\Veeam\ or C:\Program Files\Commvault\.

• Scenario: A developer or sysadmin is running a custom Python or PowerShell script to perform data migration or format conversion on a large CSV or JSON file, using a simple XOR cipher for temporary obfuscation before transferring the file over an internal network share. The YARA rule triggers on the in-memory buffer or the temporary file created during the process.

  • Filter/Exclusion: Exclude if