Unique code from Jetriz, Swid & Jeniva of the Tetris framework

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging custom or obfuscated code signatures within the Jetriz, Swid, and Jeniva components of the Tetris framework to establish persistence or evade standard detection mechanisms. Proactively hunting for these unique codes in Azure Sentinel is essential to identify early-stage lateral movement or supply chain compromises that may be missed by signature-based rules due to their low severity classification.

YARA Rule

rule apt_CN_Tetris_JS_advanced_1
{
    meta:
        author      = "@imp0rtp3 (modified by Florian Roth)"
        description = "Unique code from Jetriz, Swid & Jeniva of the Tetris framework"
        reference   = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
        date = "2020-09-06"

        id = "a56f69f5-3562-52ab-9686-411019c51055"
   strings:
      $a1 = "var a0_0x"
      $b1 = "a0_0x" ascii
      
      $cx1 = "))),function(){try{var _0x"
      $cx2 = "=window)||void 0x0===_0x"
      $cx3 = "){if(opener&&void 0x0!==opener[" //not dep on a0
      $cx4 = "String['fromCharCode'](0x"
      
      $e1 = "')](__p__)"
   condition:
   $a1 at 0 
   or (
      filesize < 1000KB
      and (
         #b1 > 300
         or #e1 > 1 
         or 2 of ($cx*)
      )
   )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• https://imp0rtp3.wordpress.com/2021/08/12/tetris
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Unique code from Jetriz, Swid & Jeniva of the Tetris framework” detection rule, including targeted filters and exclusions:

• Scenario: Scheduled Automated Backup Job

  • Context: A nightly backup routine executed by Veeam Backup & Replication utilizes the Tetris framework’s Jetriz module to compress data blocks before archiving. The unique code generation is part of the standard compression signature process, not a security event.
  • Filter/Exclusion: Create an exclusion based on the Host Name matching the backup server (e.g., SRV-BACKUP-01) and restrict the alert to occur only during the maintenance window (e.g., 02:00–04:00 UTC).
  • Logic: IF Host IN ['SRV-BACKUP-01'] AND Time BETWEEN '02:00' AND '04:00' THEN Suppress.

• Scenario: CI/CD Pipeline Deployment

  • Context: During a continuous integration run in Jenkins, the Swid component of the Tetris framework generates unique codes to validate artifact integrity during the “Build and Deploy” stage. This is expected behavior for every successful pipeline execution.
  • Filter/Exclusion: Filter alerts where the Process Name matches the CI agent (e.g., jenkins-agent.exe) and the User Account is a service account (e.g., svc-cicd-deploy).
  • Logic: IF Process_Name == 'jenkins-agent.exe' AND User_Account LIKE '%svc-cicd%' THEN Exclude.

• Scenario: Enterprise Antivirus Scanning

  • Context: The CrowdStrike Falcon endpoint security agent performs