ExeJoiner 10 Yoda f2f additional

Hunt Hypothesis

This hypothesis targets the execution of the ExeJoiner tool, a common utility used by adversaries to combine multiple executable files into a single binary to evade file-based detection mechanisms. Proactively hunting for this behavior in Azure Sentinel is critical to identify potential staging or payload delivery activities that may precede more complex post-exploitation actions.

YARA Rule

rule ExeJoiner_10_Yoda_f2f_additional: PEiD
{
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate PE File Repair or Patching Tools: Tools like PEFix, Resource Hacker, or custom internal patching scripts often manipulate the .text or .rdata sections of executable files to apply hotfixes or strip debug symbols. This can inadvertently create contiguous memory patterns or specific byte sequences that match the “Yoda” heuristic for joined executables.

  • Filter/Exclusion: Exclude processes originating from known repair tool paths (e.g., C:\Tools\PEFix\, C:\Scripts\Patching\) or filter by parent process names such as PEFix.exe, ResourceHacker.exe, or powershell.exe when the command line contains arguments like -fix or -patch.

• Antivirus/EDR Self-Update or Component Installation: During updates, security suites (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender) may temporarily write or merge DLLs and EXEs into the system directory. The “f2f” (file-to-file) logic might trigger if the AV engine reads a newly downloaded update package that contains concatenated PE headers or specific marker bytes used by the vendor’s installer.

  • Filter/Exclusion: Exclude processes where the parent is the vendor’s main service (e.g., FalconService.exe, SentinelOneAgent.exe, MsMpEng.exe) and the file path resides in the vendor’s installation directory (e.g., C:\Program Files\CrowdStrike\, C:\Program Files\SentinelOne\).

• Java/JVM Native Library Loading: When Java applications (e.g., Tomcat, WildFly, or custom JVM apps) load native libraries (.dll or .so files) that are packed or compressed, the JVM’s native loader may extract and map these libraries in a way that resembles file joining. Specific byte sequences in the native