Matches the known samples of the HatMan malware.

Hunt Hypothesis

This hunt targets adversary behavior where malicious actors deploy HatMan malware to establish persistence and exfiltrate sensitive data from Azure workloads. Proactively hunting for these specific signatures in Azure Sentinel is critical because early detection of this low-severity threat prevents lateral movement and potential data loss before the malware escalates its impact.

YARA Rule

rule hatman : hatman {
    meta:
        author = "DHS/NCCIC/ICS-CERT"
        description = "Matches the known samples of the HatMan malware."
    condition:
        filesize < 100KB and hatman_compiled_python or hatman_injector or hatman_payload
            or hatman_combined
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the HatMan Malware detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Definition Updates via Windows Update

  • Scenario: The system’s native endpoint protection (e.g., Microsoft Defender Antivirus) automatically downloads and installs new virus definition packages. These updates often contain signature databases that share file hashes or behavioral patterns with the HatMan malware samples, triggering a match during the nightly update window.
  • Filter/Exclusion: Exclude processes originating from C:\ProgramData\Microsoft\Windows Defender\Updates and specifically filter for the executable name MpCmdRun.exe or MsMpEng.exe when performing file writes to the definition folder.

• Patch Management Deployment (SCCM/Intune)

  • Scenario: During a scheduled maintenance window, the IT team deploys critical security patches using Microsoft Endpoint Configuration Manager (MECM) or Intune. The deployment agent extracts compressed archives containing known software binaries that include HatMan-like signatures as part of their standard installation payload.
  • Filter/Exclusion: Create an exclusion for the ccmexec.exe process and any child processes spawned by it, specifically targeting file paths under C:\Windows\CCMCache or C:\Program Files\Microsoft Intune Management Extension.

• Software Asset Inventory Scans

  • Scenario: A third-party asset management tool (e.g., Lansweeper, ManageEngine Endpoint Central, or SolarWinds) runs a scheduled agent scan to inventory installed software. The scanner extracts and analyzes executable files in the background, temporarily generating file hashes that collide with the HatMan known sample database.
  • Filter/Exclusion: Whitelist the specific service accounts used by these agents (e.g., svc_lansweeper, `svc_endpoint_central