DestructiveTargetCleaningTool1

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of destructive cleaning tools that may indicate an attempt to erase forensic artifacts or prepare a system for lateral movement. Proactively hunting for this activity in Azure Sentinel is essential because early identification allows the SOC team to validate legitimate maintenance tasks against potential anti-forensics campaigns before critical evidence is permanently removed.

YARA Rule

rule DestructiveTargetCleaningTool1
{
	strings:
		$s1  = {d3000000 [4] 2c000000 [12] 95000000 [4] 6a000000 [8] 07000000}
	
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DestructiveTargetCleaningTool1 detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Automated Temporary File Cleanup by Windows Task Scheduler

  • Context: The built-in Disk Cleanup utility (cleanmgr.exe) is frequently scheduled via Group Policy to run nightly on all workstations. It targets the %TEMP%, C:\Windows\Temp, and C:\Users\<User>\AppData\Local\Temp directories, deleting files older than 14 days.
  • Suggested Filter: Exclude the process path C:\Windows\System32\cleanmgr.exe when the command line arguments contain /sagerun: or target paths matching C:\Windows\Temp and %TEMP%.

• Scenario: Endpoint Protection Agent Self-Maintenance

  • Context: Enterprise EDR solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint perform routine self-cleaning tasks. These agents periodically scan their own installation directories, quarantine folders, and log repositories to remove obsolete definitions and old event logs (e.g., C:\Program Files\CrowdStrike\logs), triggering the “destructive cleaning” signature.
  • Suggested Filter: Whitelist specific EDR service executables (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\Program Files\Windows Defender\MsMpEng.exe) and exclude file operations occurring within their native installation and data directories (<Vendor>\*).

• Scenario: Database Maintenance Jobs (SQL Server/Oracle)

  • Context: Scheduled maintenance jobs for enterprise databases often involve truncating transaction logs, clearing backup history, or rotating audit files. For instance, a SQL Server job executing DBCC SHRINKFILE