FreeJoiner153Stubengine17GlOFF

Hunt Hypothesis

This detection identifies the execution of a specific stub engine associated with the FreeJoiner application, which may indicate legitimate software usage or the initial stage of a supply chain compromise involving this utility. Proactive hunting for this behavior in Azure Sentinel is essential to distinguish between expected administrative activity and potential adversary reconnaissance that leverages trusted applications to establish a foothold within the environment.

YARA Rule

rule FreeJoiner153Stubengine17GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FreeJoiner153Stubengine17GlOFF detection rule, tailored for a legitimate enterprise environment:

• Scenario: Legitimate deployment of the “FreeJoiner” remote collaboration tool by the IT Helpdesk.

  • Context: The IT team performs nightly automated updates or initial installations of FreeJoiner (a common screen-sharing and meeting utility) on endpoints using SCCM or Intune. The YARA rule flags the Stubengine process spawned during these silent installation phases as suspicious.
  • Suggested Filter/Exclusion: Exclude processes where the parent executable is ccmsetup.exe (SCCM) or Microsoft.Workplace.Joiner.exe, and the file path contains \Program Files\FreeJoiner\.

• Scenario: Scheduled antivirus heuristic scan triggering a stub engine.

  • Context: Enterprise Endpoint Detection and Response (EDR) agents, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, utilize a “stub engine” to perform on-access scanning of specific user directories. When the FreeJoiner application is accessed during these scheduled scans, the rule triggers due to the Stubengine17 component activity.
  • Suggested Filter/Exclusion: Create an exclusion based on the command line argument containing /scan-mode=heuristic and restrict the alert if the process user context is NT SERVICE\AntivirusService.

• Scenario: Automated Group Policy Object (GPO) application of configuration settings.

  • Context: A GPO refresh occurs at 02:00 AM that pushes specific registry keys or configuration files to the FreeJoiner installation directory. The system generates a temporary stub process (Stubengine17) to apply these changes, which the YARA rule interprets as an anomalous execution chain.
  • **Suggested Filter