hatman origcode

Hunt Hypothesis

This detection targets adversaries attempting to evade signature-based defenses by embedding malicious payloads within legitimate executable files using the Hatman OrigCode mechanism. Proactive hunting for this behavior in Azure Sentinel is essential to identify early-stage file integrity compromises that may bypass standard low-severity alerts before they evolve into active threats.

YARA Rule

rule hatman_origcode : hatman {
    strings:
        $ocode_be   = { 3c 00 00 03  60 00 a0 b0  7c 09 03 a6  4e 80 04 20 }
        $ocode_le   = { 03 00 00 3c  b0 a0 00 60  a6 03 09 7c  20 04 80 4e }
    condition:
        $ocode_be or $ocode_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_origcode detection rule in an enterprise environment, along with suggested filters or exclusions:

• Software Deployment via SCCM/Intune

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Intune agent executes a deployment package that includes a custom installer script. This script often invokes cmd.exe or powershell.exe with arguments pointing to temporary directories where the original file code (origcode) is being unpacked and verified before installation, mimicking the behavior of the Hatman malware’s code execution phase.
  • Suggested Filter: Exclude processes launched by ccmexec.exe (SCCM) or IntuneManagementExtension.exe where the command line contains paths under C:\Windows\CCMCache or C:\Program Files\Microsoft Intune Management Extension.

• Scheduled Antivirus Definition Updates

  • Scenario: The enterprise endpoint protection suite (e.g., CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint) runs a scheduled task to update its signature database. During this process, the AV engine spawns a helper process to download and verify the integrity of new definition files (origcode validation), which generates file system activity identical to the rule’s detection logic.
  • Suggested Filter: Create an exclusion for processes with image paths containing C:\Program Files\CrowdStrike, C:\ProgramData\SentinelOne, or C:\Windows\System32\Defender (specifically MsMpEng.exe) running during the defined maintenance window (e.g., 02:00–04:00 local time).

• Enterprise Patch Management Execution

  • Scenario: A third-party patch management tool like Ivanti Lansweeper or ManageEngine Endpoint Central runs