SuicideScriptR

Hunt Hypothesis

This detection identifies adversary behavior where malicious scripts execute self-deletion mechanisms to erase forensic artifacts and evade post-incident analysis within Azure Sentinel. Proactively hunting for this pattern is critical because early identification of these “suicide” scripts allows analysts to reconstruct deleted code before it disappears, significantly reducing the window for lateral movement and data exfiltration.

YARA Rule

rule SuicideScriptR
{
	// joanap, joanapCleaner
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$ = ":R\nIF NOT EXIST %s GOTO E\ndel /a %s\nGOTO R\n:E\ndel /a d.bat"
		
	condition:
		all of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SuicideScriptR detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Protection Self-Update Mechanism

  • Scenario: The EDR agent (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) executes a scheduled PowerShell script to download and apply the latest virus definition updates. This process often involves writing new binaries to disk, modifying registry keys related to service configurations, and terminating/restarting its own worker processes to apply changes without user intervention.
  • Filter/Exclusion: Create an exclusion based on the Process Name (C:\Program Files\CrowdStrike\fsagent.exe or MsMpEng.exe) combined with a specific Command Line Argument containing keywords like /update, /scan, or --self-repair. Additionally, exclude file paths within the vendor’s installation directory (e.g., C:\ProgramData\Microsoft\Windows Defender).

• ITSM Automated Patch Deployment

  • Scenario: A scheduled task triggered by a patch management tool (e.g., SCCM/MECM or Ivanti) runs a PowerShell script to deploy security patches. The script modifies system files, updates the Windows Registry under HKLM\SOFTWARE\Policies, and may restart specific services (like wuauserv) to finalize the installation, mimicking “suicide” behavior where the orchestrator manages its own lifecycle during the update cycle.
  • Filter/Exclusion: Filter events where the Parent Process is the Task Scheduler (svchost.exe running under TaskScheduler) and the User Account belongs to a dedicated service account (e.g., DOMAIN\PatchAdmin$). Exclude file modifications occurring in the C:\Windows\SoftwareDistribution directory.

• Configuration Management Drift Correction

  • **Scenario