HaspdongleAlladin

Hunt Hypothesis

This detection identifies the presence of the HaspdongleAlladin malware, which adversaries may deploy to establish persistence or execute initial reconnaissance activities on endpoints. SOC teams should proactively hunt for this indicator in Azure Sentinel to uncover early-stage infections that might evade standard signature-based defenses and prevent potential lateral movement within the network.

YARA Rule

rule HaspdongleAlladin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 53 51 52 57 56 8B 75 1C 8B 3E [5] 8B 5D 08 8A FB [2] 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the HaspdongleAlladin detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated USB Dongle License Verification by Microsoft Office

  • Context: In environments using hardware dongles (e.g., Sentinel or Aladdin) for software licensing (such as Adobe Creative Cloud or specialized CAD tools), the background service HaspdTm.exe or AlladinService.exe frequently scans connected USB ports to validate licenses. This triggers the rule when the process enumerates device handles during peak login times.
  • Filter/Exclusion: Create a whitelist for the specific process path and hash on the endpoint detection platform (e.g., CrowdStrike Falcon or Microsoft Defender).
    • Action: Exclude C:\Program Files\Aladdin\AlladinService.exe and C:\Program Files\Sentinel\haspdTm.exe from triggering this rule if the parent process is a known system service.

• Scenario: Scheduled IT Asset Inventory Scans

  • Context: Enterprise asset management tools like LANDesk, Ivanti Neurons, or ServiceNow Discovery run scheduled nightly jobs to inventory hardware dongles attached to workstations. These agents often interact with the Aladdin/Hasp drivers to read serial numbers and license status, mimicking the behavior of a potential security event.
  • Filter/Exclusion: Implement a time-based filter or a parent-process exclusion.
    • Action: Configure the rule to suppress alerts generated by IvantiAgent.exe or LANDeskService.exe when they spawn child processes interacting with USB drivers between 01:00 and 05:00 local time.

• Scenario: Remote Desktop Session Initialization

  • Context: When users