SuicideScriptR1 Multi

Hunt Hypothesis

This detection targets adversaries executing self-deleting scripts to erase forensic artifacts and evade post-incident analysis within Azure Sentinel. Proactive hunting for this behavior is essential to identify early-stage persistence mechanisms that might otherwise remain undetected due to their low-severity classification and transient nature.

YARA Rule

rule SuicideScriptR1_Multi
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
	
	strings:
		$ = "\" goto R1\ndel /a \""
		$ = "\"\nif exist \""
		$ = "@echo off\n:R1\ndel /a \""
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SuicideScriptR1_Multi detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Self-Update and Service Restart

  • Scenario: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne) frequently execute PowerShell scripts to update their own signatures or restart the WdNisSvc service. These scripts often include commands like Stop-Service, Remove-Job, and del .\*.exe within the same execution context, mimicking a “suicide” script designed to disable security controls before deleting itself.
  • Filter/Exclusion: Create an exclusion for processes originating from known vendor paths (e.g., C:\Program Files\CrowdStrike\, C:\ProgramData\Microsoft Defender) and specifically whitelist the parent process names (csfalcon.exe, MsMpEng.exe). Additionally, exclude scripts containing standard update keywords like “Update,” “Signature,” or “Patch” in the script body.

• Scheduled IT Asset Cleanup Jobs

  • Scenario: Automated maintenance tasks run via Windows Task Scheduler to clean up temporary files and logs on domain-joined workstations. A common job involves a PowerShell script that archives old logs, deletes the archive after verification, and then removes its own temporary working directory. This behavior triggers the rule’s logic regarding self-deletion immediately following file manipulation operations.
  • Filter/Exclusion: Filter events where the ParentProcessName is svchost.exe or TaskSchedulerService and the UserAccount matches a dedicated service account (e.g., svc-it-maintenance). Exclude script paths located in standard system directories like C:\Windows\System32\Tasks or `C:\ProgramData\Microsoft