SuicideScriptL1

Hunt Hypothesis

This detection identifies adversary behavior where malicious scripts execute self-deletion commands to remove evidence and evade forensic analysis within Azure Sentinel environments. Proactively hunting for this “Suicide Script” activity is critical because it allows SOC teams to intercept early-stage post-exploitation actions before the attacker can fully obscure their footprint, even when initial alerts are flagged as low severity.

YARA Rule

rule SuicideScriptL1
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$ = ":L1\ndel \"%s\"\nif exist \"%s\" goto L1\ndel \"%s\"\n"
	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SuicideScriptL1 detection rule in an enterprise environment, including suggested filters and exclusions:

• Antivirus Self-Update Mechanism

  • Scenario: The endpoint protection agent (e.g., CrowdStrike Falcon or Microsoft Defender) executes a scheduled update script that modifies its own configuration files and deletes temporary installation artifacts to prevent version conflicts. This behavior mimics the “self-deletion” logic often associated with suicide scripts used by malware.
  • Filter/Exclusion: Create an exclusion for the specific process path of the AV service (e.g., C:\Program Files\CrowdStrike\csagent.exe) and its child processes executing PowerShell or Batch scripts in the installation directory (C:\ProgramData\CrowdStrike\).

• Patch Management Deployment Agents

  • Scenario: Enterprise patch management tools like Microsoft SCCM (Configuration Manager) or Ivanti Endpoint Manager run scheduled maintenance tasks. These agents often deploy a script to apply updates, verify the installation, and then delete the temporary script file from the system drive (C:\Windows\Temp or C:\ProgramData) once the job completes successfully to free up disk space.
  • Filter/Exclusion: Exclude events where the parent process is identified as the patch management service (e.g., ccmexec.exe for SCCM) and the script execution path matches known deployment directories (e.g., paths containing \SMS\CCM\).

• IT Automation & Configuration Management Tools

  • Scenario: Infrastructure automation platforms such as Ansible, Chef, or Puppet execute “idempotent” configuration scripts. During a compliance check, these tools may generate a temporary script to enforce registry settings, execute it, and immediately remove the script file after execution to ensure the system state remains clean