Thinstall2628Jtit

Hunt Hypothesis

This detection identifies the execution of a specific installer process matching the “Thinstall2628Jtit” signature, which may indicate an adversary leveraging legitimate software installation to establish persistence or deliver initial payloads within the environment. Proactive hunting for this behavior in Azure Sentinel is essential to validate whether these installations are authorized and to uncover potential supply chain compromises or early-stage lateral movement that standard alerts might overlook due to their low severity classification.

YARA Rule

rule Thinstall2628Jtit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
	$a1 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Thinstall2628Jtit detection rule, detailing legitimate enterprise activities that trigger the YARA signature along with recommended filters or exclusions:

• Scenario: Automated Patch Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During scheduled maintenance windows, SCCM pushes cumulative updates and application patches to endpoints. The installation process often involves temporary extraction of installer binaries that match the Thinstall2628Jtit signature before finalizing the install.
  • Filter/Exclusion: Create a rule exclusion for processes spawned by ccmsetup.exe or wuauserv.exe. Additionally, exclude file paths located within the standard SCCM cache directory: C:\Windows\CCMCache\*.

• Scenario: Scheduled Group Policy Object (GPO) Software Installation

  • Context: A nightly GPO task triggers a silent installation of enterprise-wide utilities (e.g., Adobe Acrobat Reader or Java Runtime). The execution of the installer (msiexec.exe) running under the SYSTEM account often generates the specific artifact pattern detected by this YARA rule.
  • Filter/Exclusion: Filter alerts where the parent process is gpupdate.exe or svchost.exe (specifically the gpsvc service) and the user context is NT AUTHORITY\SYSTEM. Exclude file paths matching C:\ProgramData\Microsoft\Group Policy\*.

• Scenario: Endpoint Detection and Response (EDR) Self-Update Mechanism

  • Context: The organization’s EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs a self-update of its detection engine. This process involves unpacking new definition files that mimic the structure of the Thinstall2628Jtit signature, causing a collision