XComp 097 098 EXE JoKo

Hunt Hypothesis

This hypothesis targets the execution of specific executable files identified by the YARA signature “JoKo,” which may indicate the presence of a known or emerging malware strain or a tool used for initial access or payload delivery. Proactively hunting for these indicators in Azure Sentinel allows the SOC to identify compromised endpoints or suspicious processes before they can establish persistence or exfiltrate data, reducing the dwell time of potential threats.

YARA Rule

rule XComp_097_098_EXE_JoKo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? 9C 60 E8 75 06 00 00 34 ?? 01 00 00 00 00 00 00 00 00 00 4C ?? 01 00 34 ?? 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 59 ?? 01 00 6A ?? 01 00 79 ?? 01 00 88 ?? 01 00 96 ?? 01 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Joko utility (a common Java-based or C++ compiled helper tool used in specific internal build pipelines or legacy application deployments) during a scheduled nightly deployment job.
  • Filter/Exclusion: Exclude processes where the parent process is cmd.exe or powershell.exe initiated by a scheduled task named *Deploy* or *Build*, and the file path matches C:\Builds\Tools\Joko\*.exe.
• Scenario: A developer manually runs the Joko executable from a shared network drive (\\fileserver\dev\tools\) to perform local unit test compilation or code obfuscation tasks on a developer workstation.
  • Filter/Exclusion: Exclude if the user account belongs to the DevTeam security group and the file path starts with \\fileserver\dev\ or C:\Users\<dev_user>\AppData\Local\Temp\.
• Scenario: The Joko binary is invoked as a post-install script by a standard MSI installer (e.g., msiexec.exe) during the deployment of a legacy internal application package that bundles this specific helper tool.
  • Filter/Exclusion: Exclude if the parent process is msiexec.exe and the command line contains /i (install) or /a (admin) flags, or if the file path is located within C:\Program Files\<InternalApp>\.
• Scenario: A CI/CD agent (e.g., Jenkins, Azure DevOps) executes Joko.exe as part of a pipeline step to generate version stamps or license keys before packaging the final artifact.
  • Filter/Exclusion: Exclude if the parent process is java.exe (Jenkins agent) or agent.exe (Azure DevOps) and