MicroJoiner17coban2k

Hunt Hypothesis

This detection identifies potential malicious activity from the MicroJoiner17coban2k process, which may indicate an adversary leveraging a legitimate utility for initial access or lateral movement within the environment. The SOC team should proactively hunt for this behavior in Azure Sentinel to validate whether observed instances represent benign administrative tasks or early-stage indicators of compromise that require deeper investigation.

YARA Rule

rule MicroJoiner17coban2k
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the MicroJoiner17coban2k detection rule, along with recommended filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Deployment

  • Context: The SCCM client service (ccmexec.exe) frequently executes a background process named microjoiner to deploy software updates or join devices to specific groups during the nightly maintenance window. This triggers the YARA rule due to the executable’s signature matching the detection logic.
  • Filter/Exclusion: Exclude processes where the parent image is C:\Windows\CCM\ccmexec.exe and the file path contains \Microsoft Endpoint Configuration Manager\. Alternatively, add a filter for process names ending in .exe running under the NT SERVICE\CcmExec user context.

• Scenario: Windows Scheduled Task “MicroJoiner Health Check”

  • Context: An enterprise-wide scheduled task (TaskName: MicroJoiner_DailyHealth) runs every morning at 06:00 AM to validate device connectivity and join status. The task executes a local script that invokes the microjoiner utility, causing the YARA rule to flag it as a potential new or suspicious execution.
  • Filter/Exclusion: Create an exclusion based on the specific Scheduled Task Name (MicroJoiner_DailyHealth) or exclude executions where the command line arguments contain /health-check. This can be implemented by filtering events with TaskName matching the regex ^MicroJoiner.*.

• Scenario: Group Policy Object (GPO) Startup Script Execution

  • Context: A GPO applied to the “Engineering” OU triggers a startup script that runs microjoiner.exe --mode=init on all joined workstations. This occurs during user logon, often coinciding with other