Fusion10jaNooNi

Hunt Hypothesis

This detection identifies specific file artifacts matching the “Fusion10jaNooNi” YARA signature, which likely indicates early-stage adversary activity such as a new malware variant or suspicious script execution within the environment. SOC teams should proactively hunt for this indicator in Azure Sentinel to validate its behavior across endpoints and determine if it represents a novel threat requiring immediate containment or further investigation despite its current low severity classification.

YARA Rule

rule Fusion10jaNooNi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Fusion10jaNooNi detection rule, including suggested filters and exclusions:

• Antivirus Definition Updates via Microsoft Defender

  • Scenario: The Microsoft Defender Antivirus service (MsMpEng.exe) periodically downloads and installs new virus definition updates. This process often involves unpacking compressed archives or executing embedded scripts that match the heuristic patterns of Fusion10jaNooNi, triggering an alert when a legitimate update package is being processed in the background.
  • Suggested Filter: Exclude processes where the parent image path matches C:\Program Files\Windows Defender\MsMpEng.exe and the file extension is .cab or .msi.

• Scheduled Office 365 ProPlus Click-to-Run Updates

  • Scenario: The Microsoft Office Click-to-Run service (OfficeClickToRun.exe) runs a scheduled job (typically via Task Scheduler) to check for and apply feature updates. During this execution, the service extracts temporary installation files that mimic the behavior detected by the YARA rule, particularly when deploying new language packs or security patches across the enterprise network.
  • Suggested Filter: Create an exclusion for the process OfficeClickToRun.exe running under the context of the “System” account, specifically targeting file paths within C:\Program Files\Microsoft Office Root\Office16.

• Enterprise Patch Deployment via SCCM/Intune

  • Scenario: System Center Configuration Manager (SCCM) or Microsoft Intune agents (ccmexec.exe or DeviceCdpAgent.exe) execute a nightly deployment task to install cumulative updates. The rule may trigger when these agents extract and verify the integrity of large deployment packages, which contain similar binary structures to those flagged by Fusion10jaNooNi.