Detects indicators of a Java loader used in phishing campaigns

Hunt Hypothesis

This detection identifies adversaries leveraging malicious Java loaders to execute initial access payloads within phishing campaigns, often serving as a precursor for deeper system compromise. Proactively hunting for these indicators in Azure Sentinel is critical because Java-based loaders frequently bypass standard email security controls, requiring specialized telemetry analysis to intercept threats before they establish persistence or exfiltrate sensitive data.

YARA Rule

rule SUSP_JAVA_Loader_Indicators_Aug25 {
   meta:
      description = "Detects indicators of a Java loader used in phishing campaigns"
      author = "Florian Roth"
      reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
      date = "2025-08-07"
      score = 70
      hash1 = "c4cf746fce283878dde567e5457a8ebdbb7ff3414be46569ecdd57338bd96fa1"
      id = "ed83b697-4e48-504c-8a65-af0a5b765c9d"
   strings:
      $s1 = "Loader.classPK" ascii fullword
      $s2 = "stubPK" ascii
      $s3 = "META-INF/MANIFEST.MFPK" ascii
   condition:
      uint16(0) == 0x4b50
      and filesize < 500KB
      and $s1 in (filesize - 224..filesize)
      and $s2 in (filesize - 224..filesize)
      and $s3 in (filesize - 224..filesize)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the “Java Loader Phishing” detection rule, including suggested filters and exclusions:

Scenario: Enterprise Email Client Plugin Updates
- Context: Modern email clients like Microsoft Outlook or IBM Lotus Notes often utilize embedded Java Virtual Machines (JVM) to render complex HTML emails, process attachments with macros, or run third-party add-ins (e.g., Salesforce for Outlook). When a user opens an internal newsletter containing interactive charts or a secure attachment viewer, the system spawns java.exe or javaw.exe processes that mimic the behavior of external phishing loaders.
- Filter/Exclusion: Exclude processes where the parent process is OUTLOOK.EXE (or NOTES.EXE) and the command line contains specific internal domain parameters (e.g., -Djava.home=C:\Program Files\Java\JRE...). Additionally, whitelist Java versions known to be deployed via Microsoft Endpoint Configuration Manager (SCCM) or Intune within the last 30 days.
Scenario: Scheduled BI and Reporting Dashboards
- Context: Business Intelligence platforms such as Tableau Server, SAP BusinessObjects, or Oracle Hyperion frequently rely on Java loaders to generate scheduled PDF reports, render interactive dashboards in a browser context, or execute ETL jobs. These services often run as background Windows Services that periodically invoke java.exe to fetch data and render visualizations, which can trigger the rule during peak business hours.
- Filter/Exclusion: Create an exclusion for processes running under specific service accounts (e.g., DOMAIN\svc_tableau, DOMAIN\svc_sap) where the executable path matches known installation directories (e.g., C:\Program Files\Tableau\Tableau Server\...). Filter out events occurring during defined maintenance windows (e.g.,