FreeJoiner 152 Stub engine 16 GlOFF additional

Hunt Hypothesis

This hypothesis targets the presence of FreeJoiner 152 stub engine artifacts, which are often associated with the initial stages of malware infection or process injection techniques that adversaries use to establish a foothold in memory. Proactively hunting for these specific YARA signatures in Azure Sentinel allows the SOC team to identify low-severity, potentially stealthy loader components before they progress to more impactful post-exploitation activities.

YARA Rule

rule FreeJoiner_152_Stub_engine_16_GlOFF_additional: PEiD
{
    strings:
        $a = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a lightweight, open-source build tool or script runner (e.g., Taskfile, Just, or a custom Python/Go wrapper) that dynamically generates or modifies executable stubs for CI/CD pipeline artifacts. The “GlOFF” signature might match the specific byte pattern of the generated stub header or the embedded engine metadata.

  • Filter/Exclusion: Exclude processes where the parent process is a known build tool (e.g., task.exe, just.exe, python.exe running a build script) and the file path resides in a designated build/, dist/, or artifacts/ directory.

• Scenario: An IT administrator deploys a custom PowerShell or Batch script to patch or update a legacy application component that uses a “stub” loader mechanism. The script may create a temporary executable or modify an existing binary in the C:\Program Files\... or C:\Temp directory, triggering the YARA rule if the binary structure matches the “FreeJoiner 152 Stub engine 16” pattern.

  • Filter/Exclusion: Exclude files created by processes running from the C:\Windows\System32 or C:\Program Files\PowerShell directories, or specifically exclude files with a .tmp or .bak extension in temporary directories (C:\Temp, C:\Users\<user>\AppData\Local\Temp) that are created and deleted within a short time window (e.g., < 5 minutes).

• Scenario: A security team or QA engineer runs a fuzzing or mutation testing tool (e.g., AFL++, Honggfuzz, or a custom C++ fuzzer) against a target application. The fuzzer generates numerous mutated binaries or stubs