Detects Hatman malware

Hunt Hypothesis

This rule detects the presence of Hatman malware by identifying its specific execution patterns and file artifacts within the Azure Sentinel environment. Proactive hunting for this threat is essential to uncover early-stage infections that may evade standard signature-based detection, allowing the SOC team to mitigate potential data exfiltration or lateral movement before escalation occurs.

YARA Rule

rule hatman_compiled_python : hatman {
    meta:
        description = "Detects Hatman malware"
        reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
        date = "2017/12/19"
        author = "DHS/NCCIC/ICS-CERT"
        id = "fd156669-72b4-59a5-8f36-aac21d7b3105"
    condition:
        hatman_nullsub and hatman_setstatus and hatman_dividers
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

References

• https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects Hatman malware” rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Full Scan by Microsoft Defender

  • Context: The daily scheduled full scan performed by Microsoft Defender Antivirus often triggers deep file system enumeration and process creation that mimics the behavior of Hatman malware (which is known for aggressive scanning and registry modification). This frequently occurs during off-hours when the rule’s sensitivity is highest.
  • Filter/Exclusion: Create an exclusion based on the Process Name being MsMpEng.exe or Antimalware Service Executable, combined with a time-based filter to exclude alerts generated between 01:00 and 05:00 UTC during scheduled maintenance windows.

• Scenario: Endpoint Configuration Management via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents push configuration updates, registry keys, and software packages to endpoints. The installation of these policies involves writing to the HKLM\Software hive and creating new service entries, which overlaps significantly with Hatman’s persistence mechanisms.
  • Filter/Exclusion: Exclude alerts where the parent process is CcmExec.exe (SCCM) or IntuneManagementExtension.exe, specifically filtering out events related to “Policy Application” or “Software Deployment” actions that match the rule’s specific registry modification signatures.

• Scenario: Legacy Backup Agent Activity (Veeam/Commvault)

  • Context: Enterprise backup agents like Veeam Agent for Windows or Commvault often perform incremental scans and snapshot creation, which involves heavy I/O operations and temporary file generation in the C:\ProgramData directory. Hatman malware is known to target similar directories; the backup agent’s process tree can be mis