Disclosed hacktool set (old stuff) - file splitjoin.exe

Hunt Hypothesis

This hunt detects adversaries leveraging legacy or repurposed hacking tools like splitjoin.exe to execute command-line operations that may indicate post-compromise activity such as data staging or lateral movement. Proactive hunting for this behavior in Azure Sentinel is critical because the use of “old stuff” often suggests an attacker attempting to blend into existing infrastructure by utilizing trusted, less-monitored utilities to evade standard detection mechanisms.

YARA Rule

rule splitjoin {
	meta:
		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
	strings:
		$s0 = "Not for distribution without the authors permission" fullword wide
		$s2 = "Utility to split and rejoin files.0" fullword wide
		$s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
		$s19 = "SplitJoin" fullword wide
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file splitjoin.exe detection rule, including recommended filters and exclusions:

• Scenario: Legacy Media Conversion Workflow

  • Context: The marketing department uses an older version of Adobe Creative Cloud or a specialized legacy media tool that bundles splitjoin.exe as a dependency for batch processing large video files. This process often runs during off-hours via the Windows Task Scheduler.
  • Filter/Exclusion: Create a whitelist entry for the specific file path (e.g., C:\Program Files\Adobe\LegacyTools\bin\splitjoin.exe) and exclude processes spawned by Task Scheduler (sched.exe) when executing this specific binary.

• Scenario: Automated Backup & Archive Routine

  • Context: The IT Operations team utilizes a third-party backup solution (e.g., Veeam Agent for Windows or Acronis Cyber Protect) that employs splitjoin.exe to split large archive images into manageable chunks before transmission over the network. This is triggered by a daily cron job or scheduled task.
  • Filter/Exclusion: Exclude alerts where the parent process is the backup service executable (e.g., VeeamService.exe or AcronisCyberProtect.exe) and the file hash of splitjoin.exe matches the known good signature from the vendor’s documentation.

• Scenario: Software Deployment via SCCM/Intune

  • Context: During a scheduled software deployment window, the Microsoft Endpoint Configuration Manager (SCCM) or Intune agent executes a custom installation package for an internal application. This package includes splitjoin.exe to merge split installer files on the endpoint before launching the main setup wizard.
  • Filter/Exclusion: Filter out events where the