hatman memcpy

Hunt Hypothesis

This hunt hypothesis targets adversaries employing memory-based exploitation techniques, such as unauthorized data copying or payload injection, which often evade traditional disk-centric detection methods. A proactive search within Azure Sentinel is essential to identify these subtle in-memory activities early, preventing potential stealthy attacks before they escalate into significant security incidents.

YARA Rule

rule hatman_memcpy : hatman {
    meta:
        id = "ddbd452a-bf74-5dcb-98a6-034846188aa5"
    strings:
        $memcpy_be  = { 7c a9 03 a6  38 84 ff ff  38 63 ff ff  8c a4 00 01
                        9c a3 00 01  42 00 ff f8  4e 80 00 20              }
        $memcpy_le  = { a6 03 a9 7c  ff ff 84 38  ff ff 63 38  01 00 a4 8c
                        01 00 a3 9c  f8 ff 00 42  20 00 80 4e              }
    condition:
        $memcpy_be or $memcpy_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the hatman_memcpy detection rule, including targeted filters and exclusions:

• Antivirus Real-Time Scanning & Heuristic Analysis

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform real-time heuristic scans. These agents often load signature databases into memory and copy large chunks of file data to analyze them against known malware patterns, triggering the memcpy logic as a potential injection event.
  • Filter/Exclusion: Create an exclusion rule in the EDR policy to whitelist processes belonging to the specific AV vendor (e.g., C:\Program Files\CrowdStrike\csagent.exe). Additionally, exclude file paths within the AV installation directory and their temporary cache folders from memory monitoring.

• Scheduled Backup and Snapshot Operations

  • Scenario: Automated backup solutions such as Veeam Agent, Rubrik, or Commvault run scheduled jobs during off-hours to create point-in-time snapshots of virtual machines or physical servers. These tools utilize in-memory data copying mechanisms to stage data before writing it to the storage repository, which mimics the payload injection behavior detected by the rule.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00 – 04:00 UTC). Alternatively, add process exclusions for specific backup daemons (e.g., vss.exe, vcagent.exe) and exclude the specific memory regions used by these services.

• CI/CD Pipeline Artifact Processing

  • Scenario: In DevOps environments, build agents like Jenkins, GitLab Runner, or Azure Pipelines execute on dedicated servers to compile code and package artifacts. During