FreeJoiner152Stubengine16GlOFF

Hunt Hypothesis

This detection identifies the execution of a specific stub engine associated with the FreeJoiner application, which may indicate legitimate software usage or potential obfuscation by an adversary leveraging known benign processes to mask malicious activity. SOC teams should proactively hunt for this behavior in Azure Sentinel to validate its context against baseline user activities and ensure that any deviations do not represent a covert persistence mechanism or initial foothold within the environment.

YARA Rule

rule FreeJoiner152Stubengine16GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FreeJoiner152Stubengine16GlOFF detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Endpoint Protection Updates

  • Context: The enterprise utilizes CrowdStrike Falcon or Microsoft Defender for Endpoint. During nightly maintenance windows (e.g., 02:00 AM), the agent automatically downloads and installs a new stub engine update to patch vulnerabilities. This process often instantiates the FreeJoiner152Stubengine16GlOFF binary as part of the installation handshake, triggering the YARA rule despite being a benign administrative task.
  • Filter/Exclusion: Configure an exclusion based on the Process Name (FreeJoiner.exe) combined with the Parent Process. Exclude alerts where the parent process is FalconSensorService.exe (CrowdStrike) or MsMpEng.exe (Microsoft Defender) running under the SYSTEM account.

• Scenario: Third-Party Deployment Tool Execution

  • Context: The IT Operations team uses Ivanti Neurons or SCCM (System Center Configuration Manager) to push software updates across the fleet. When deploying a specific patch package that includes legacy joiner components, the deployment agent executes FreeJoiner152Stubengine16GlOFF as a temporary worker process on client machines during business hours.
  • Filter/Exclusion: Create a rule exclusion for processes spawned by known deployment agents. Filter alerts where the parent executable is ccmexec.exe (SCCM) or IvantiAgentService.exe, and the file path resides within the standard installation directory: C:\Program Files\Ivanti\ or C:\Windows\CCM\.

• Scenario: Automated Backup Agent Initialization

  • **Context