hatman dividers

Hunt Hypothesis

This hunt hypothesis targets adversaries employing sophisticated file and script obfuscation techniques to evade standard signature-based detection within Azure Sentinel environments. Proactively hunting for these specific ‘hatman_dividers’ patterns allows the SOC team to identify early-stage advanced threats that may otherwise remain hidden in low-severity alerts, thereby reducing dwell time before potential compromise.

YARA Rule

rule hatman_dividers : hatman {
    meta:
        id = "8c88e1d9-c7bf-5df0-80e9-7ea4ad45c20b"
    strings:
        $div1       = { 9a 78 56 00 }
        $div2       = { 34 12 00 00 }
    condition:
        $div1 and $div2
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_dividers YARA rule, including suggested filters and exclusions:

• Scenario: Automated Build Pipeline Artifacts

  • Context: CI/CD platforms like Jenkins, GitLab Runner, or Azure DevOps frequently generate obfuscated build scripts (PowerShell or Python) that include complex string concatenation and hex-encoded payloads to manage dependencies. These artifacts often mimic the “advanced threat actor” obfuscation patterns targeted by the rule during nightly builds.
  • Filter/Exclusion: Exclude files located in known CI/CD working directories (e.g., C:\Jenkins\workspace\*, /var/lib/gitlab-runner/builds/*) and exclude processes running under specific service accounts such as JENKINS-BUILD-SVC or GITLAB-RUNNER.

• Scenario: Enterprise Endpoint Protection Updates

  • Context: Security vendors like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint deploy updated definition packs and heuristic engines that utilize heavy obfuscation to prevent reverse engineering. The installation of these updates often triggers the hatman_dividers rule due to the presence of compressed, encoded script blocks within the update agents.
  • Filter/Exclusion: Create an exclusion list for executable paths belonging to known security vendors (e.g., C:\Program Files\CrowdStrike\*\*, C:\Windows\System32\Defender\*) and filter out events where the parent process is a trusted update service like wuauserv.exe or csfplgsvc.exe.

• Scenario: Scheduled PowerShell Reporting Jobs

  • Context: IT Operations teams often schedule complex reporting tasks using Windows Task Scheduler that execute long-running PowerShell scripts. These scripts frequently employ Base64