ExeJoiner10Yodaf2f

Hunt Hypothesis

This detection identifies the execution of a specific binary pattern associated with the “ExeJoiner” tool, which adversaries often leverage to dynamically merge or modify executable components during lateral movement and payload delivery phases. Proactively hunting for this signature in Azure Sentinel is essential to uncover stealthy file manipulation activities that may evade standard behavioral alerts due to their low severity classification.

YARA Rule

rule ExeJoiner10Yodaf2f
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ExeJoiner10Yodaf2f detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Context: During a scheduled maintenance window, SCCM deploys a new application package to endpoints. The deployment agent (ccmexec.exe) frequently spawns child processes that utilize the ExeJoiner logic to merge executable components or update manifest files, triggering the YARA match.
  • Filter/Exclusion: Exclude process paths containing C:\Program Files\Microsoft Configuration Manager\AdminConsole\bin\ccmexec.exe. Alternatively, create a filter where the parent process name is ccmexec.exe and the execution time falls within the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: CrowdStrike Falcon Sensor Update Service

  • Context: The CrowdStrike Falcon sensor (csfalcon.exe) performs periodic self-healing or signature updates. During this process, it invokes a utility to join and verify executable integrity signatures that match the ExeJoiner10Yodaf2f pattern, often occurring immediately after system boot or during the daily update cycle.
  • Filter/Exclusion: Add an exclusion for any process where the parent name is csfalcon.exe and the file hash matches a known good baseline of the CrowdStrike update utility. Additionally, exclude events originating from the specific service account SYSTEM when the executable path resides within C:\Program Files\CrowdStrike\.

• Scenario: Automated Backup Job via Veeam Agent

  • Context: A nightly scheduled backup job initiated by Veeam Agent for Microsoft Windows (VeeamAgent.exe) performs a pre-backup integrity check