hatman dividers

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing specific “hatman” file structure patterns to stage or exfiltrate data while evading standard signature-based detection. The SOC team should proactively hunt for these dividers in Azure Sentinel to identify early-stage lateral movement or command-and-control activity that may precede more critical security incidents.

YARA Rule

rule hatman_dividers : hatman {
    strings:
        $div1       = { 9a 78 56 00 }
        $div2       = { 34 12 00 00 }
    condition:
        $div1 and $div2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_dividers detection rule in an enterprise environment, including suggested filters and exclusions:

• Scheduled Antivirus Full Scans

  • Scenario: Enterprise endpoint protection tools (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) initiate scheduled full-system scans during off-hours. These scanners often create temporary staging files with specific header/footer structures that mimic the hatman_dividers signature while processing large archives.
  • Filter/Exclusion: Exclude file paths containing known AV quarantine directories (e.g., C:\ProgramData\Microsoft\Windows Defender\Scans\History) and filter by process names such as MsMpEng.exe, csfalcon.exe, or CrowdStrikeService.exe.

• Automated Compliance Reporting Jobs

  • Scenario: Identity and Access Management (IAM) platforms like Okta or SailPoint run nightly batch jobs to generate compliance reports. These jobs often write intermediate log files containing specific delimiter patterns used by the rule’s YARA logic before finalizing the PDF/CSV output.
  • Filter/Exclusion: Create an exclusion for processes running under the context of service accounts (e.g., svc_okta_reporter or sailpoint_agent) and restrict alerts to files located in temporary reporting directories (e.g., /var/tmp/compliance_reports).

• CI/CD Pipeline Artifact Generation

  • Scenario: Build automation tools like Jenkins, GitLab CI, or Azure DevOps generate build artifacts and container images. During the “packaging” phase, these tools frequently write manifest files and split large binaries using dividers that match the hatman_dividers heuristic.
  • Filter/Exclusion: Exclude execution paths associated with build agents (e.g., /var/lib/jenkins/workspace, `C:\Program Files\