FreeJoinerSmallbuild031032GlOFF

Hunt Hypothesis

This rule targets a specific, low-severity YARA signature that likely identifies a known benign or minor variant of a software component, potentially serving as a baseline for detecting unexpected process injections or file modifications. Proactively hunting for this signature allows the SOC team to validate that the identified artifact matches expected inventory and to quickly isolate any instances where it appears in anomalous contexts or unauthorized locations.

YARA Rule

rule FreeJoinerSmallbuild031032GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 32 ?? 66 8B C3 58 E8 ?? FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer manually runs the FreeJoinerSmallbuild031032GlOFF utility (a small, custom-built joiner script or binary) from a local workstation or build agent to test data merging logic before deploying it to production.
  • Filter/Exclusion: Exclude files where the path contains \bin\ or \tools\ and the parent process is cmd.exe, powershell.exe, or bash.exe on non-production hosts. Alternatively, whitelist the specific SHA256 hash of the known good build artifact.
• Scenario: A scheduled maintenance job (e.g., via Windows Task Scheduler or Cron) executes the FreeJoinerSmallbuild031032GlOFF binary to consolidate log files or database dumps nightly on a dedicated data processing server.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (for Task Scheduler) or cron/crond (on Linux), and the target host is tagged as role=data-processor or env=staging.
• Scenario: A CI/CD pipeline (e.g., Jenkins, GitHub Actions, or Azure DevOps) checks out the repository and runs the FreeJoinerSmallbuild031032GlOFF script as part of the unit test or integration test suite on a build runner.
  • Filter/Exclusion: Exclude events where the user account matches the CI/CD service account (e.g., jenkins-agent, github-actions-runner, or azure-devops-pool) and the working directory is within the standard build workspace path (e.g., /home/runner/work/ or C:\jenkins\workspace\).
• Scenario: An IT administrator performs a manual troubleshooting step by copying the `Free