Detects a final Java loader JAR file used in phishing campaigns

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging malicious Java loader JAR files as the final execution stage of sophisticated phishing campaigns to establish persistence or deliver payloads within the organization’s Azure Sentinel environment. Proactively hunting for these artifacts is essential because they often bypass initial email filters and represent a critical entry point for supply chain attacks that can lead to widespread credential theft or lateral movement if not identified early.

YARA Rule

rule MAL_JAVA_Loader_Final_Jar_Aug25 {
   meta:
      description = "Detects a final Java loader JAR file used in phishing campaigns"
      author = "Florian Roth"
      reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
      date = "2025-08-07"
      score = 85
      hash1 = "0a7fddd91b332c8daee2c0727b884fc92cfaede02883dbad75f7efc299e884e3"
      id = "17894519-060b-5414-8430-d6d025e7db83"
   strings:
      $s1 = "Obfuscation by Allatori Obfuscator" ascii fullword
      $s2 = "MANIFEST.MFM" ascii fullword
      $s3 = "GetCpu.classPK" ascii fullword
      $s4 = "extra/spreader" ascii fullword
   condition:
      all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects a final Java loader JAR file used in phishing campaigns” rule, along with recommended filters and exclusions:

Scenario: Automated Build Pipelines Executing Artifact Staging
- Context: CI/CD tools like Jenkins, GitLab Runner, or Azure DevOps Agents frequently download, unpack, and execute .jar files containing Java loaders during the deployment of microservices or legacy applications. These agents often run on dedicated build servers where the execution of a loader JAR is part of the standard workflow, not user-initiated phishing activity.
- Filter/Exclusion: Create an exclusion based on the Host Name or Process Parent. Exclude alerts where the parent process is java.exe (PID > 1000) running under a specific service account (e.g., svc-jenkins-build) and the host belongs to the “Build-Server” OU. Alternatively, filter by file path if the JAR resides in a known artifact repository directory (e.g., C:\jenkins\workspace\artifacts\).
Scenario: Scheduled Enterprise Reporting Jobs
- Context: Business Intelligence platforms such as Tableau Server, SAP BusinessObjects, or custom internal reporting tools often utilize Java-based loader JARs to generate nightly PDF reports or aggregate data. These jobs are triggered by the Windows Task Scheduler at specific times (e.g., 02:00 AM) and execute a known, signed .jar file that matches the detection signature but is benign.
- Filter/Exclusion: Implement a time-based filter to suppress alerts for this rule during off-hours (e.g., 01:00–05:00 local time) on hosts tagged as “Reporting-Node.” Additionally, add an exclusion for specific file hashes