Detects Hatman malware

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging the Hatman malware to inject malicious payloads into targeted systems via the hatman_injector mechanism. A SOC team should proactively search for this behavior in Azure Sentinel to identify early-stage compromise indicators that may be missed by standard alerting due to the rule’s low severity classification.

YARA Rule

rule hatman_injector : hatman {
    meta:
        description = "Detects Hatman malware"
        reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
        date = "2017/12/19"
        modified = "2023-01-09"
        author = "DHS/NCCIC/ICS-CERT"
        id = "b939b83d-cc4a-5998-89a7-8abf8d0b8592"
    condition:
        ( hatman_memcpy and hatman_origaddr and hatman_loadoff )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

References

• https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the “Detects Hatman malware” rule, including suggested filters and exclusions:

• Scenario: Scheduled Antivirus or EDR Full Scans

  • Context: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black often perform scheduled full-system scans during off-hours. These scanners frequently inject their own analysis modules into the memory space of running processes to detect threats, which can mimic the injection behavior targeted by the hatman_injector YARA signature.
  • Suggested Filter/Exclusion: Create an exclusion based on the parent process name and path. Exclude alerts where the parent process is a known security agent (e.g., C:\Program Files\CrowdStrike\csagent.exe, C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.xxxxx\mpcmdrun.exe) performing a scan operation.

• Scenario: Application Deployment via Microsoft Endpoint Configuration Manager (SCCM)

  • Context: During software deployment or patching cycles, the System Center Configuration Manager (SCCM/MECM) client service (ccmexec.exe) often injects code into user sessions to install updates or configure policies. This injection mechanism can trigger the hatman_injector rule if the deployment package contains similar binary structures or uses standard Windows API calls for process injection that overlap with Hatman’s signature.
  • Suggested Filter/Exclusion: Implement a logic filter to suppress alerts where the parent process is ccmexec.exe and the event time aligns with defined maintenance windows (e.g., 02:00–04:00 local time). Additionally, exclude file paths located within the SCCM installation directory (C:\Program Files\Microsoft Configuration Manager).