EXEjoinerAmok

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the EXEJoiner utility to dynamically merge executable modules, a technique often used by malware to evade static analysis and obfuscate malicious payloads within legitimate processes. A SOC team should proactively hunt for this behavior in Azure Sentinel because early detection of these modular assembly patterns can reveal stealthy command-and-control or fileless attack stages that traditional signature-based rules might overlook.

YARA Rule

rule EXEjoinerAmok
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the EXEjoinerAmok detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Build Pipelines Executing Artifact Merging

  • Context: CI/CD platforms like Azure DevOps, Jenkins, or GitHub Actions often utilize build agents to merge multiple compiled object files into a single executable during the packaging phase. These agents frequently invoke EXEjoiner (or similar utility) on high-I/O network shares where source code resides.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under specific service accounts (e.g., AZURE-DEVOPS-BUILD, JENKINS-SVC) and restrict the rule to trigger only when the parent process is not a known build orchestrator (msbuild.exe, java.exe).
  • Filter Logic: ProcessName IN ('EXEjoiner.exe') AND ParentImage NOT IN ('jenkins-agent.exe', 'azagent.worker.exe', 'teamcity-agent.exe')

• Scenario: Scheduled Endpoint Protection Policy Updates

  • Context: Enterprise EDR solutions such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often perform scheduled maintenance tasks that repackage security definitions. During these windows, the EDR engine may spawn a background utility to join updated definition modules into a single executable payload before deployment.
  • Suggested Filter/Exclusion: Exclude activity occurring during defined maintenance windows (e.g., 02:00–04:00 local time) and filter for processes spawned by the EDR’s core engine service.
  • Filter Logic: `ProcessName == ‘EXEjoiner.exe’ AND ParentImage IN (‘falcon-sensor.exe’, ‘MsMpEng.exe’)