Disclosed hacktool set (old stuff) - file splitjoin.exe

Hunt Hypothesis

This hunt detects adversaries leveraging legacy or repurposed hacking tools like splitjoin.exe to establish persistence and manipulate data within the environment. Proactive hunting is essential in Azure Sentinel because such “old stuff” often evades standard signature-based detection, allowing attackers to operate stealthily before initiating broader compromise activities.

YARA Rule

rule SplitJoin_V1_3_3_rar_Folder_3 {
	meta:
		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "21409117b536664a913dcd159d6f4d8758f43435"
	strings:
		$s2 = "[email protected]" fullword ascii
		$s3 = "splitjoin.exe" fullword ascii
		$s7 = "SplitJoin" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file splitjoin.exe detection rule, along with recommended filters and exclusions:

• Legacy Media Management Tool Execution

  • Scenario: The enterprise utilizes a legacy media archiving solution (e.g., Acronis Cyber Backup or Veritas Storage Foundation) that relies on an older version of splitjoin.exe to segment large backup images into manageable chunks before transmission. This process often runs during off-hours via the Windows Task Scheduler under the SYSTEM account.
  • Filter/Exclusion: Create a filter to exclude alerts where the parent process is AcronisService.exe or vssvc.exe, and the file path resides within the vendor’s installation directory (e.g., C:\Program Files\Acronis\...).

• Scheduled Disk Partitioning Maintenance

  • Scenario: A nightly maintenance job executed by a system administrator uses the Microsoft Sysinternals Suite or a custom PowerShell script to manage disk partitions. The script invokes splitjoin.exe (a utility often bundled with older partition management tools like Partition Magic or GParted Windows wrappers) to split large virtual hard disks (VHDs) for snapshot creation.
  • Filter/Exclusion: Exclude alerts where the command line arguments contain specific flags such as /split, /join, or --snapshot, and the execution occurs between 01:00 and 05:00 on weekdays via a scheduled task named “NightlyDiskMaintenance”.

• Software Deployment Package Processing

  • Scenario: The IT Operations team uses Microsoft Endpoint Configuration Manager (MECM) or Ivanti Neurons to deploy large software updates. During the pre-processing phase of the deployment package, the system extracts compressed archives