hatman loadoff

Hunt Hypothesis

This detection identifies potential adversary activity involving the loading of malicious modules or scripts by the Hatman process, which may indicate early-stage fileless execution or living-off-the-land techniques. Proactively hunting for this behavior in Azure Sentinel is essential to uncover stealthy threats that evade traditional signature-based defenses and could serve as a precursor to more complex lateral movement or data exfiltration campaigns.

YARA Rule

rule hatman_loadoff : hatman {
    meta:
        id = "59229427-e982-59af-8fed-59b3db4b5374"
    strings:
        $loadoff_be = { 80 60 00 04  48 00 ?? ??  70 60 ff ff  28 00 00 00
                        40 82 ?? ??  28 03 00 00  41 82 ?? ??              }
        $loadoff_le = { 04 00 60 80  ?? ?? 00 48  ff ff 60 70  00 00 00 28
                        ?? ?? 82 40  00 00 03 28  ?? ?? 82 41              }
    condition:
        $loadoff_be or $loadoff_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for “hatman loadoff” Rule

• Scenario: Antivirus Engine Signature Updates

  • Context: Major endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection frequently trigger the loadoff behavior during their scheduled daily signature definition updates. The engine loads new modules into memory, mimicking the specific YARA pattern detected by the rule.
  • Suggested Filter: Exclude processes where the executable path matches known antivirus installation directories (e.g., C:\Program Files\CrowdStrike\..., C:\ProgramData\Microsoft\Windows Defender\...) and restrict the alert to non-business hours if updates are scheduled for 02:00–04:00.

• Scenario: Scheduled PowerShell Script Execution by System Administrators

  • Context: Admins often run custom maintenance scripts via Task Scheduler that utilize System.Management.Automation or specific .NET assemblies to manage user access or patch deployment. These scripts frequently invoke the loadoff mechanism when initializing new management sessions or loading configuration modules.
  • Suggested Filter: Create an exclusion for processes spawned by svchost.exe (specifically those with the “TaskScheduler” service tag) or direct executions of powershell.exe where the command line arguments contain keywords like -ExecutionPolicy Bypass, -File, or specific internal script paths (e.g., \Scripts\Maintenance\).

• Scenario: Enterprise Backup and Archiving Tools

  • Context: Solutions such as Veeam Backup & Replication, Commvault, or Rubrik perform nightly data indexing and load offloading tasks. During the “loadoff” phase of their backup cycles, these tools instantiate temporary workers that match the YARA signature logic for memory loading patterns.