This detection identifies the presence of potentially malicious or unauthorized JIT (Just-In-Time) software installations that may indicate an adversary attempting to establish persistence through legitimate system tools. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy initial access attempts where attackers leverage trusted installation mechanisms to evade standard signature-based defenses.
rule Thinstall24x25xJititSoftware
{
meta:
author="malware-lu"
strings:
$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D [4] B9 [4] BA [4] BE [4] BF [4] BD [4] 03 E8 }
condition:
$a0 at pe.entry_point
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Here are 3-5 specific false positive scenarios for the Thinstall24x25xJititSoftware detection rule, including suggested filters and exclusions:
Scenario: Scheduled Patch Deployment via Microsoft Endpoint Configuration Manager (SCCM)
ccmexec.exe) initiates a scheduled task during business hours to deploy the “JIT IT Software” update package. This process triggers the YARA rule because the installer executable matches the signature while running under the SYSTEM account.C:\Windows\CCM\ccmexec.exe and the user context is NT AUTHORITY\SYSTEM. Alternatively, create a whitelist entry for the specific SCCM package ID associated with this software deployment.Scenario: Automated Onboarding Script Execution
OnboardUser.ps1) executed via Task Scheduler to install baseline security tools on new workstations. When provisioning a new user account, the script launches install24x25.exe (the JITIT installer) as part of the sequence, triggering the alert before the user logs in.\Scripts\Onboarding\ or filter alerts where the command line arguments contain specific flags like /silent /norestart. Additionally, exclude events occurring on machines tagged with a “New-Device” AD attribute within the first 24 hours of creation.Scenario: Endpoint Protection Agent Self-Repair