HASPHLProtectionV1XAladdin

Hunt Hypothesis

This hypothesis targets the presence of the HASPHLProtectionV1XAladdin YARA signature, which indicates the execution of a specific malware family or protection mechanism often associated with fileless or packed payloads. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious processes before they can establish persistence or exfiltrate data, leveraging low-severity detections to reduce alert fatigue while maintaining visibility into emerging threat actors.

YARA Rule

rule HASPHLProtectionV1XAladdin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 8B C4 A3 [4] B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 15 8B 0D [4] 51 FF 15 [4] 83 C4 04 E9 A5 00 00 00 68 [4] FF 15 [4] A3 [4] 68 [4] FF 15 }
	$a1 = { 55 8B EC 53 56 57 60 8B C4 A3 [4] B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 15 8B 0D [4] 51 FF 15 [4] 83 C4 04 E9 A5 00 00 00 68 [4] FF 15 [4] A3 [4] 68 [4] FF 15 [4] A3 [4] 8B 15 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An administrator manually updates the Aladdin HASPHL Protection agent on a critical domain controller or file server using the vendor-provided AladdinUpdater.exe or Setup.exe installer. The YARA rule may match the binary signature or specific memory patterns of the updater process during the installation phase.

  • Filter/Exclusion: Exclude processes where the parent process is msiexec.exe or setup.exe and the image path contains \Aladdin\ or \HASPHL\. Additionally, exclude events where the process name is AladdinUpdater.exe or AladdinSetup.exe and the command line contains arguments like /install or /update.

• Scenario: A scheduled maintenance job runs the Aladdin HASPHL Protection service restart or configuration script (e.g., restart-service.ps1 or apply-policy.cmd) via Task Scheduler on a fleet of endpoints. The YARA rule might trigger if it inspects the script content or the associated service executable (AladdinSvc.exe) during a policy refresh.

  • Filter/Exclusion: Exclude events where the parent process is svchost.exe (specifically the netsvcs or netsvcs group) or TaskScheduler related processes, and the image path ends with AladdinSvc.exe or AladdinService.exe. Ensure the exclusion applies only when the command line includes standard service management verbs like restart, start, or stop.

• Scenario: An IT operations team uses a remote management tool like SCCM (System Center Configuration Manager) or Intune to push a new version of the HASPHL Protection agent to a large group of devices. The agent’s self-extraction or installation helper process (e.g., AladdinHelper.exe) may be flagged by the YARA rule during the deployment window.

  • **Filter