jjencode detection

Hunt Hypothesis

This hypothesis targets adversaries employing obfuscation techniques to encode malicious payloads within legitimate scripts, thereby evading traditional signature-based detections that struggle with complex character sequences. Proactively hunting for this behavior in Azure Sentinel is essential to identify stealthy command-and-control communications or data exfiltration attempts that may otherwise remain hidden due to the low severity and generic nature of standard alerts.

YARA Rule

rule jjEncode
{
   meta:
      description = "jjencode detection"
      ref = "http://blog.xanda.org/2015/06/10/yara-rule-for-jjencode/"
      author = "[email protected]"
      date = "10-June-2015"
      version = "1"
      impact = 3
      hide = false
   strings:
      $jjencode = /(\$|[\S]+)=~\[\]\;(\$|[\S]+)\=\{[\_]{3}\:[\+]{2}(\$|[\S]+)\,[\$]{4}\:\(\!\[\]\+["]{2}\)[\S]+/ fullword 
   condition:
      $jjencode
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the jjencode detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated CI/CD Pipeline Execution

  • Context: Build agents (e.g., Jenkins, GitLab Runner) frequently process JavaScript source code containing eval() or dynamic object instantiation during the compilation phase. The build tool often invokes a helper script that utilizes jjencode to obfuscate temporary configuration files before deployment.
  • Filter/Exclusion: Create an exclusion rule for processes running under specific service accounts (e.g., svc-jenkins, gitlab-runner) and restrict the scope to known build directories (e.g., C:\Builds\Artifacts or /var/lib/gitlab-runner).

• Scenario: Scheduled Antivirus Heuristic Scans

  • Context: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon or Microsoft Defender for Endpoint perform scheduled heuristic scans on the file system. During these scans, the agent may decode and re-encode JavaScript artifacts in real-time to check for polymorphic malware signatures, triggering a jjencode signature match.
  • Filter/Exclusion: Exclude the EDR engine’s primary process (e.g., csagent.exe, MsMpEng.exe) from this specific detection rule when the action is “File Scan” or “Heuristic Check,” rather than “Process Execution.”

• Scenario: Browser-Based Admin Dashboard Refresh

  • Context: Administrators accessing internal web portals (e.g., ServiceNow, Splunk Enterprise) via Microsoft Edge or Chrome often trigger dynamic UI rendering. The browser’s JavaScript engine processes encoded JSON payloads to render real-time charts and dashboards, which can mimic the byte-patterns of jjencode obfuscation.
  • Filter/Exclusion: Filter