DestructiveTargetCleaningTool5

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing specialized destructive cleaning tools to sanitize endpoints and obscure forensic artifacts following an initial compromise. Proactive hunting for this behavior in Azure Sentinel is critical because early detection of these sanitization activities can reveal post-exploitation actions before data exfiltration or system degradation occurs, even when the associated alerts carry a low severity rating.

YARA Rule

rule DestructiveTargetCleaningTool5
{
	strings:
		$MCU_DLL_ZLIB_COMPRESSED2 = { 5C EC AB AE 81 3C C9 BC D5 A5 42 F4 54 91 04 28 34 34 79 80 6F 71 D5 52 1E 2A 0D }
	
	condition:
		$MCU_DLL_ZLIB_COMPRESSED2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DestructiveTargetCleaningTool5 detection rule, including suggested filters and exclusions:

• Scenario: Enterprise Endpoint Protection Maintenance

  • Context: The organization’s managed antivirus solution (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) executes a scheduled “Deep Scan” or “Quarantine Cleanup” task. These tools often invoke native Windows utilities like cleanmgr.exe or custom scripts to remove temporary files and obsolete logs, mimicking the behavior of destructive cleaning tools targeted by the YARA rule.
  • Suggested Filter/Exclusion: Create an exclusion based on the Process Image Path and Parent Process. Exclude alerts where the process path matches known AV installation directories (e.g., C:\Program Files\CrowdStrike\*) or is spawned directly by the Windows Task Scheduler (svchost.exe with specific service arguments) during standard maintenance windows.

• Scenario: Automated Patch Management and Software Deployment

  • Context: During a monthly patch cycle, deployment tools such as Microsoft SCCM (Configuration Manager), Ivanti, or Jamf Pro run post-installation cleanup routines. These agents often execute scripts to remove temporary installer files (*.tmp, *.msi) and rollback artifacts from the %TEMP% directory after successfully deploying updates like .NET Framework patches or Office 365 builds.
  • Suggested Filter/Exclusion: Implement a filter based on User Context and Command Line Arguments. Exclude events where the user account is a dedicated service account (e.g., DOMAIN\SCCM_Service_Agent) and the command line contains flags specific to deployment tools, such as /quiet, /norestart, or references to specific software catalog IDs.

• **Scenario: Legacy Application Log