NJoy13NEX

Hunt Hypothesis

This YARA rule targets specific memory or file patterns associated with the NJoy13NEX signature, potentially indicating the presence of a low-severity web shell, backdoor, or embedded script within Azure-hosted workloads. Proactively hunting for this signature allows the SOC team to identify dormant or stealthy footholds that may have bypassed initial network-based detections, ensuring early containment of persistent access mechanisms in the Azure environment.

YARA Rule

rule NJoy13NEX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the njoy utility (a common name for various legacy or custom internal tools, e.g., njoy.exe or njoy13n scripts) during a scheduled database maintenance window.
  • Filter/Exclusion: Exclude processes where the parent process is sqlservr.exe or oracle.exe and the file path resides in C:\Program Files\Internal Tools\ or C:\Scripts\Maintenance\.
• Scenario: A developer or DBA manually running a custom Perl or Python script named njoy13n.py or njoy13n.pl to parse log files or generate reports, often invoked via cmd.exe or powershell.exe from a user’s home directory.
  • Filter/Exclusion: Exclude if the parent process is cmd.exe or powershell.exe and the user is a member of the DBA or DevOps security group, provided the file extension is .py, .pl, or .ps1.
• Scenario: A legacy application installer or updater (e.g., njoy13n_setup.exe) running during a patch Tuesday deployment via a service like WinRM or PsExec.
  • Filter/Exclusion: Exclude if the parent process is WinRM.exe, PsExec.exe, or wmi32.exe and the execution occurs within the defined patch window (e.g., 02:00–04:00 UTC) on servers tagged with Role=AppServer.
• Scenario: A custom internal monitoring agent or health check script named njoy13n_check.bat or njoy13n.sh being executed by a scheduled task (Task Scheduler) or cron job on Linux servers.