FreeJoinerSmallbuild014021024027GlOFF

Hunt Hypothesis

This detection identifies the execution of a specific build artifact associated with the “FreeJoiner” application, which may indicate legitimate software deployment or potential supply chain compromise involving this component. SOC teams should proactively hunt for this activity in Azure Sentinel to validate its expected context and distinguish between routine operations and anomalous behavior that could signal an adversary leveraging known binaries for initial access.

YARA Rule

rule FreeJoinerSmallbuild014021024027GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Based on the detection rule title FreeJoinerSmallbuild014021024027GlOFF, which suggests a YARA signature targeting a specific build version of the FreeJoiner utility (likely used for document merging, PDF processing, or file joining in an enterprise context), here are 5 specific false positive scenarios and their corresponding filters:

• Scenario 1: Automated Document Merging by IT Operations

  • Context: The IT Operations team runs a nightly scheduled job using the FreeJoiner utility to merge daily transaction logs from multiple sub-departments into a single master PDF report. This process executes via a Windows Task Scheduler trigger on the file server, launching the specific build version of FreeJoiner detected by the rule.
  • Filter/Exclusion: Create an exclusion based on the Process Name (FreeJoiner.exe) and Command Line Path. Exclude alerts where the executable path matches \\FileServer\Tools\Utils\FreeJoinerSmallbuild014021024027GlOFF.exe AND the parent process is TaskScheduler.exe.

• Scenario 2: User-Initiated Report Generation in Finance

  • Context: Senior Financial Analysts frequently use a custom macro within Microsoft Excel that calls the FreeJoiner utility to combine monthly balance sheets. When analysts click “Generate Combined Report,” the local instance of FreeJoiner (matching the specific build hash) is launched from their workstation’s C:\Program Files\FinanceTools directory.
  • Filter/Exclusion: Implement a filter excluding alerts where the User Account belongs to the FINANCE-ANALYSTS security group AND the process origin path contains \FinanceTools\. Additionally, exclude if the parent process is EXCEL.EXE.

• **Scenario 3: Third-Party Archive