NJoiner01AsmVersionNEX

Hunt Hypothesis

This detection identifies potential anomalies in the .NET assembly versioning of the ‘NJoiner’ component, which may indicate supply chain compromises or unauthorized code modifications within the application layer. Proactively hunting for this signal in Azure Sentinel allows the SOC team to validate legitimate software updates against known baselines before they evolve into broader integrity incidents across the environment.

YARA Rule

rule NJoiner01AsmVersionNEX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NJoiner01AsmVersionNEX detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Patch Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Context: During nightly maintenance windows, the SCCM client service (ccmexec.exe) executes a task sequence to install or update the NJoiner agent. This process involves unpacking the installer and writing version metadata files that match the YARA signature for NEX versions.
  • Filter/Exclusion: Create an exclusion rule based on the parent process name ccmexec.exe running from the path C:\Program Files (x86)\Microsoft Configuration Manager\. Additionally, exclude events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: IT Admin Manual Installation via PowerShell Script

  • Context: An administrator runs a custom PowerShell script (Update-NJoiner.ps1) to push the latest NJoiner version to a specific set of workstations. The script invokes msiexec.exe or directly calls the installer executable, triggering file creation events that resemble the detection logic for new assembly versions.
  • Filter/Exclusion: Exclude alerts where the parent process is powershell.exe and the command line contains keywords such as -Command, Update-NJoiner, or specific admin user accounts (e.g., DOMAIN\IT-Admins).

• Scenario: Automated Cloud Backup Agent Scanning

  • Context: A cloud backup solution like Veeam or Rubrik runs a scheduled job that scans the installation directory of NJoiner. The backup agent’s indexing process reads and potentially touches version manifest files, causing the YARA rule to fire on file access patterns associated with `N