FreeJoinerSmallbuild033GlOFF

Hunt Hypothesis

This rule targets the execution of the FreeJoiner small build, a known tool often used by adversaries to establish persistence or facilitate lateral movement through undocumented or low-profile system interactions. Proactively hunting for this specific indicator in Azure Sentinel allows the SOC to identify early-stage footholds or dormant backdoors that may evade broader behavioral detections, ensuring timely containment of potential supply chain or insider threats.

YARA Rule

rule FreeJoinerSmallbuild033GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via SCCM/MECM: The FreeJoinerSmallbuild033GlOFF binary (often a custom or repackaged installer for niche line-of-business software) is deployed to endpoints via Microsoft System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager (MECM). The process runs under the SYSTEM or a dedicated deployment service account, potentially triggering the rule if it executes from a non-standard path like C:\Windows\Temp or C:\ProgramData.
  • Filter/Exclusion: Exclude the rule if the parent process is CcmExec.exe or TaskEng.exe and the user context is NT AUTHORITY\SYSTEM.
• Scheduled Maintenance Task for Third-Party Middleware: A scheduled task (e.g., via Windows Task Scheduler) runs FreeJoinerSmallbuild033GlOFF.exe nightly to update or validate a specific middleware component (such as a legacy ESB or message queue agent). The executable is located in a vendor-specific directory like C:\Program Files\VendorName\Agent\.
  • Filter/Exclusion: Exclude the rule if the file path matches C:\Program Files\VendorName\ and the parent process is svchost.exe or TaskScheduler.exe.
• Manual Troubleshooting by L2/L3 Support: An L2 or L3 support engineer manually copies the FreeJoinerSmallbuild033GlOFF diagnostic tool to a user’s desktop or C:\Users\<Admin>\Downloads to troubleshoot a connectivity issue. The tool is executed directly from the user profile directory, which is a common false positive trigger for YARA rules looking for binaries in user-writable paths.
  • Filter/Exclusion: Exclude the rule if the file path contains C:\Users\ and the parent process is `