Disclosed hacktool set - file Clear.bat

Hunt Hypothesis

This detection identifies adversaries deploying a batch script named “Clear.bat” as part of their hacktool execution phase to establish persistence or execute initial command-and-control routines within Azure Sentinel environments. Proactive hunting for this specific artifact is critical because such scripts often serve as the first stage in an attack chain, enabling threat actors to clear logs, download additional payloads, or manipulate system configurations before escalating privileges.

YARA Rule

rule Hacktools_CN_Burst_Clear {
	meta:
		description = "Disclosed hacktool set - file Clear.bat"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
	strings:
		$s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
		$s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
		$s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
		$s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
		$s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
		$s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
		$s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
		$s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
		$s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set - file Clear.bat detection rule, including targeted filters and exclusions:

• Scenario: Automated Build Pipeline Cleanup

  • Context: CI/CD platforms like Jenkins, GitLab Runner, or Azure DevOps Agents frequently execute build scripts that generate temporary .bat files (often named Clear.bat) to remove artifacts, clean working directories, or reset environments before the next pipeline stage. These agents often run under dedicated service accounts with elevated privileges.
  • Filter/Exclusion: Exclude execution paths located within standard CI/CD agent directories (e.g., C:\ProgramData\Jenkins\workspace\*, D:\Builds\Agent\*\) and filter for specific user contexts like SYSTEM or Jenkins-Build-Service.

• Scenario: Endpoint Management Tool Maintenance

  • Context: Enterprise endpoint management solutions such as Microsoft Intune, SCCM (Configuration Manager), or Tanium often deploy custom maintenance scripts to clear browser caches, reset network configurations, or remove temporary logs. These tools frequently utilize a generic Clear.bat script deployed via Group Policy or application deployment packages.
  • Filter/Exclusion: Create an exclusion for processes spawned by known management binaries (e.g., ccmexec.exe, IntuneManagementExtension.exe) and restrict the rule to exclude files located in C:\Program Files\Microsoft Intune Management Extension\ or similar vendor-specific installation paths.

• Scenario: Scheduled Daily Log Rotation

  • Context: Internal IT operations teams often configure Windows Task Scheduler jobs to run nightly maintenance routines. A common task involves a script named Clear.bat that archives old logs, truncates large event files, or clears temp folders (C:\Temp, `%TEMP%