hatman compiled python

Hunt Hypothesis

This detection identifies adversaries utilizing Hatman to compile Python scripts into executable binaries, a technique designed to evade static analysis and signature-based defenses by obscuring source code. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover stealthy command-and-control or payload delivery mechanisms that might otherwise bypass traditional script monitoring controls.

YARA Rule

rule hatman_compiled_python : hatman {
    condition:
        filesize < 100KB and hatman_nullsub and hatman_setstatus and hatman_dividers
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_compiled_python detection rule in an enterprise environment, including suggested filters and exclusions:

• Automated CI/CD Pipeline Artifacts

  • Scenario: The Jenkins or GitLab Runner service on a build server compiles Python scripts (e.g., using pyinstaller or cython) as part of the nightly deployment pipeline. This activity involves creating compiled bytecode (.pyc) and executable binaries that match the rule’s signature, even though no malicious “Hatman” malware is present.
  • Filter/Exclusion: Exclude file paths located within standard CI/CD working directories (e.g., C:\Jenkins\workspace\, /var/lib/gitlab-runner/builds/) and restrict alerts to the specific service account running the build agent (e.g., svc-jenkins-build).

• Scheduled Data Engineering Tasks

  • Scenario: The nightly execution of Apache Airflow or Azure Data Factory jobs triggers Python-based ETL processes. These tasks frequently compile custom Python libraries on worker nodes before processing large datasets, generating file system events that mimic the rule’s trigger conditions.
  • Filter/Exclusion: Create an exclusion for scheduled task names containing keywords like “Airflow”, “DataFactory”, or “ETL_Job” and whitelist the specific hash signatures of known Python interpreters (e.g., python.exe from C:\Program Files\Python39) used by these orchestration tools.

• Enterprise Endpoint Management Deployments

  • Scenario: During a scheduled maintenance window, the SCCM (System Center Configuration Manager) or Intune agent pushes a software update that includes Python runtime dependencies. The installation process compiles scripts to verify integrity and configure local environments on thousands of endpoints simultaneously.
  • Filter/Exclusion: Filter alerts based on