FreeJoinerSmallbuild023GlOFF

Hunt Hypothesis

This detection identifies the presence of a specific software build artifact associated with the “FreeJoiner” application, which may indicate legitimate deployment or potential supply chain compromise if found in unexpected locations. SOC teams should proactively hunt for this indicator within Azure Sentinel to validate its authorized status across endpoints and prevent undetected lateral movement by adversaries leveraging known benign tools.

YARA Rule

rule FreeJoinerSmallbuild023GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the FreeJoinerSmallbuild023GlOFF detection rule, tailored for a legitimate enterprise environment:

• Scenario: Automated CI/CD Pipeline Execution on Build Agents

  • Context: During nightly builds, the internal build server (e.g., Jenkins or Azure DevOps) executes the FreeJoiner utility to compile small modules. The YARA rule matches the binary hash of the tool running in a temporary working directory (C:\Builds\Temp\...).
  • Filter/Exclusion: Exclude processes where the executable path contains \Builds\ or \Agent_Workspace\ and the parent process is jenkins-agent.exe, vstsagent.exe, or docker-entrypoint.sh.

• Scenario: Scheduled Group Policy Update Deployment

  • Context: The IT Operations team deploys a scheduled Group Policy Object (GPO) that pushes the FreeJoiner configuration tool to all domain-joined workstations at 2:00 AM. This triggers the detection on hundreds of endpoints simultaneously as the local system account runs the installation script.
  • Filter/Exclusion: Create an exclusion for events where the user context is NT AUTHORITY\SYSTEM and the process command line includes keywords like /silent, /install, or specific GPO version identifiers (e.g., gpo_version_2023).

• Scenario: Third-Party Endpoint Security Agent Scanning

  • Context: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a real-time scan or on-demand update, launching the FreeJoiner utility as part of its own telemetry collection or policy enforcement module.
  • Filter/Exclusion: Exclude detections where the parent process name matches known security agents such as `FalconSensor.exe