MicroJoiner11coban2k

Hunt Hypothesis

This rule detects the execution of the MicroJoiner Cobalt Strike beacon, a lightweight implant often used by adversaries for initial access or lateral movement within Azure environments. Proactively hunting for this specific beacon allows the SOC to identify compromised workloads or containers that may be leveraging this low-noise tool to establish persistent command-and-control channels before traditional network-based detections trigger.

YARA Rule

rule MicroJoiner11coban2k
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Scenario: A DevOps engineer runs a custom Python-based deployment script that utilizes the requests library to join multiple API endpoints or data streams, where the script’s memory footprint or specific string patterns (e.g., variable names like joiner, coban, or micro) coincidentally match the YARA rule’s byte sequences.
  • Suggested Filter: Exclude processes where the parent process is python.exe or python3.exe and the command line arguments contain deploy, script, or .py file paths.
• Legitimate Scenario: An IT administrator uses a legitimate third-party utility named “MicroJoiner” (or similar) for disk partition management or data recovery, which is a signed executable located in C:\Program Files\ or C:\Tools\.
  • Suggested Filter: Exclude files with a valid digital signature from known vendors (e.g., Microsoft, Symantec, or the specific tool’s publisher) and located in standard installation directories (Program Files, Program Files (x86), C:\Tools).
• Legitimate Scenario: A scheduled task for log aggregation runs a PowerShell script that uses Join-Path or string concatenation logic in a loop, where the script’s compiled bytecode or temporary file content matches the YARA pattern due to specific variable naming conventions (e.g., $coban2k as a legacy variable name).
  • Suggested Filter: Exclude processes where the parent is powershell.exe or pwsh.exe and the command line contains Join-Path, Get-Content, or references to log directories like C:\Logs\ or D:\Archive\.
• Legitimate Scenario: A developer tests a new internal library in a local IDE (e.g., Visual Studio Code or JetBrains) where the project folder is