hatman filesize

Hunt Hypothesis

This detection identifies potential Hatman malware activity by monitoring for executable files that match specific size characteristics defined in the YARA signature. A proactive hunt is essential to uncover early-stage infections that may evade standard heuristic scans, allowing the SOC team to isolate affected assets before lateral movement occurs within the Azure Sentinel environment.

YARA Rule

rule hatman_filesize : hatman {
    condition:
        filesize < 100KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the hatman filesize detection rule in an enterprise environment, including tailored filters and exclusions:

• Antivirus Quarantine & Backup Operations

  • Scenario: Enterprise Endpoint Protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently scan large files or move them to a quarantine folder. This process often involves reading the full file content, which can trigger filesize anomalies if the rule expects smaller payloads. Similarly, scheduled backup agents like Veeam or Commvault may stage large temporary files during incremental backups.
  • Filter/Exclusion: Exclude processes running under C:\Program Files\CrowdStrike\ and C:\ProgramData\Veeam\. Add a condition to ignore alerts where the file extension is .tmp, .vbk, or .qar if the process name matches known backup agents.

• Software Deployment via SCCM/Intune

  • Scenario: During mass deployment windows, tools like Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune download large installation packages (.msi, .exe) to client machines before execution. The initial write of these multi-gigabyte payloads often mimics the behavior of a suspicious file drop detected by the hatman_filesize logic.
  • Filter/Exclusion: Create an exclusion for process names containing ccmsetup.exe, intune-agent.exe, and msiexec.exe. Filter out events where the parent process is wsappx.exe (Windows Update App) during business hours (08:00–18:00).

• Database Maintenance and Log Rotation

  • Scenario: Scheduled maintenance jobs for enterprise databases (SQL Server, Oracle) or log aggregation tools (Splunk Heavy Forwarder, **Elastic