hatman combined

Hunt Hypothesis

This detection targets adversary behavior involving the execution of Hatman malware components, which often serve as initial footholds for lateral movement and credential theft within cloud environments. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage compromises before they escalate into significant data exfiltration or ransomware events.

YARA Rule

rule hatman_combined : hatman {
    condition:
        filesize < 100KB and hatman_injector_int and hatman_payload_int and hatman_dividers
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_combined detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Policy Updates via Microsoft Defender

  • Scenario: The scheduled daily update of definition files and engine versions by the Microsoft Defender Antivirus service triggers file creation and hash changes that mimic the initial infection or configuration modification patterns detected by hatman_combined. This often occurs on the first run after a patch cycle.
  • Filter/Exclusion: Exclude processes originating from MsMpEng.exe (Microsoft Antimalware Service Executable) when the parent process is svchost.exe with the service name WinDefend, specifically targeting file paths under C:\ProgramData\Microsoft\Windows Defender.

• Group Policy Object (GPO) Application during Logon

  • Scenario: During peak business hours, the Group Policy Client Service (gpsvc) applies security policies that modify registry keys and deploy configuration scripts to user profiles. The hatman_combined rule may flag these legitimate script executions (e.g., .vbs, .ps1) as suspicious activity if they involve file system enumeration or temporary file creation similar to the threat’s behavior.
  • Filter/Exclusion: Create an exclusion for processes named gpupdate.exe and cmd.exe when launched by svchost.exe (service: gpsvc), filtering specifically for execution paths within C:\Windows\System32\GroupPolicy or C:\Users\<User>\AppData\Local\Microsoft\Windows\INetCache.

• Automated Software Deployment via SCCM/Intune

  • Scenario: The System Center Configuration Manager (SCCM) client (ccmexec.exe) or Microsoft Intune Management Extension runs scheduled application installations and software updates. These tasks often involve extracting compressed