hatman memcpy

Hunt Hypothesis

This hunt targets adversaries leveraging the Hatman memcpy mechanism to execute memory-based operations that may indicate early-stage malware activity or fileless attacks within Azure Sentinel workloads. Proactively hunting for this behavior is critical because its low-severity classification often allows subtle, persistent threats to evade standard alerting thresholds before they escalate into significant incidents.

YARA Rule

rule hatman_memcpy : hatman {
    strings:
        $memcpy_be  = { 7c a9 03 a6  38 84 ff ff  38 63 ff ff  8c a4 00 01 
                        9c a3 00 01  42 00 ff f8  4e 80 00 20              }
        $memcpy_le  = { a6 03 a9 7c  ff ff 84 38  ff ff 63 38  01 00 a4 8c
                        01 00 a3 9c  f8 ff 00 42  20 00 80 4e              }
    condition:
        $memcpy_be or $memcpy_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_memcpy detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Real-Time Scanning and Quarantine Operations

  • Scenario: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently perform memory copying operations to scan running processes, analyze file integrity, or move files into quarantine vaults. These legitimate background activities often involve high-frequency memcpy calls that mimic the behavior of the Hatman malware.
  • Filter/Exclusion: Create an exclusion based on the process image path and parent process. Exclude alerts where the executable is located in standard vendor directories (e.g., C:\Program Files\CrowdStrike\, C:\Windows\System32\) and the parent process is a known security service (e.g., csfalcon.exe, sssd.exe, or MsMpEng.exe).

• Enterprise Backup and Snapshot Agents

  • Scenario: Scheduled backup jobs using tools like Veeam Agent, Commvault, or AWS Systems Manager (SSM) agents often copy large memory blocks to create snapshots or transmit data to central repositories. These operations trigger significant memcpy events during their scheduled maintenance windows, which can be misidentified as malicious memory manipulation.
  • Filter/Exclusion: Implement a time-based filter combined with process name matching. Exclude alerts generated by processes named VeeamAgent.exe, cvpdaemon.exe, or AmazonSSMAgent.exe specifically during defined maintenance windows (e.g., 02:00–04:00 UTC) when backup schedules are active.

• Software Deployment and Patch Management Execution

  • Scenario: During system updates, deployment tools