FreeJoinerSmallbuild035GlOFF

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the specific “FreeJoinerSmallbuild035GlOFF” binary signature to establish a foothold or execute initial reconnaissance within the environment. Proactively hunting for this indicator in Azure Sentinel is essential because its low severity classification suggests it may represent early-stage activity that could be overlooked by automated alerts, requiring manual investigation to confirm benign status or detect subtle compromise signals.

YARA Rule

rule FreeJoinerSmallbuild035GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the FreeJoinerSmallbuild035GlOFF YARA rule detection, along with targeted filters and exclusions:

• Scenario: Automated Build Pipeline Execution

  • Context: The CI/CD pipeline (e.g., Jenkins or GitLab Runner) on a build server executes the FreeJoiner utility as part of the nightly compilation process to merge small binary artifacts. This triggers the YARA signature during high-volume build windows.
  • Filter/Exclusion: Exclude processes running under the specific service account (e.g., NT SERVICE\jenkins) or restrict detection to non-business hours if builds are strictly scheduled for 02:00–04:00 UTC. Alternatively, add a path exclusion for the build directory: C:\Builds\Pipelines\FreeJoiner\*.exe.

• Scenario: Scheduled Database Maintenance Job

  • Context: A nightly SQL maintenance job utilizes the FreeJoiner tool to optimize index fragmentation and join operations on the reporting database. The rule fires when the scheduled task launches the utility via Task Scheduler under a dedicated admin account (e.g., DOMAIN\DBMaint).
  • Filter/Exclusion: Create an exclusion based on the parent process ID (PPID). If the parent process is svchost.exe or taskscheduler.exe, suppress the alert. Additionally, whitelist the specific command line argument used by the maintenance script: -mode=optimize -db=ReportingDB.

• Scenario: Third-Party Backup Agent Integration

  • Context: The enterprise backup solution (e.g., Veeam or Commvault) invokes FreeJoinerSmallbuild035GlOFF as a pre-backup hook to consolidate log files before archiving. This occurs during the standard backup window on all file servers.