ExeJoiner10Yoda

Hunt Hypothesis

This rule detects the presence of the ExeJoiner10Yoda tool, a utility often used by adversaries to pack or obfuscate executable files to evade static analysis and signature-based detection. Proactively hunting for this artifact in Azure Sentinel allows the SOC team to identify potential staging or deployment activities involving obfuscated payloads before they are executed or chained with further malicious actions.

YARA Rule

rule ExeJoiner10Yoda
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a custom build script that employs 7z (7-Zip) or tar to bundle multiple small executable files (e.g., .dlls, .exe helpers) into a single archive for deployment to edge devices or containers. The YARA rule may match the specific header structure or string patterns of the joined binary if it mimics the “ExeJoiner” signature.
  • Filter/Exclusion: Exclude files located in specific build directories (e.g., C:\Builds\, C:\CI\) or exclude processes where the parent process is 7z.exe, tar.exe, or python.exe executing a known build script.
• Scenario: An enterprise application installer (e.g., Adobe Creative Cloud, Microsoft Office, or SAP) uses a self-extracting archive (SFX) or a custom joiner utility to combine the main installer with its dependency libraries into a single .exe for distribution. The resulting binary contains the characteristic byte sequences that trigger the Yoda rule.
  • Filter/Exclusion: Whitelist known installer executables by their digital signature (e.g., Adobe Inc., Microsoft Corporation) or exclude files in standard installation cache directories (e.g., C:\ProgramData\Adobe\, C:\Windows\Installer\).
• Scenario: A security team or IT admin uses a legitimate tool like PE Explorer or a custom PowerShell script to create a portable, single-file executable for a diagnostic utility (e.g., joining netstat.exe, tasklist.exe, and a custom .ps1 script) to be copied to a jump host or endpoint for troubleshooting.
  • Filter/Exclusion: Exclude files where the path contains keywords like diag, tool, or portable in the directory name, or exclude if