hatman nullsub

Hunt Hypothesis

This detection targets adversaries leveraging the Hatman tool to perform null-substitution obfuscation on payloads, a technique designed to evade signature-based security controls by masking malicious content. A proactive hunt in Azure Sentinel is essential because this specific evasion method often bypasses standard network and endpoint detections, requiring deep inspection of process execution and file artifacts to uncover hidden threats that might otherwise remain undetected during routine monitoring.

YARA Rule

rule hatman_nullsub : hatman {
    meta:
        id = "feaf2242-1db8-5a30-a420-d826b9038266"
    strings:
        $nullsub     = { ff ff 60 38  02 00 00 44  20 00 80 4e }
    condition:
        $nullsub
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_nullsub detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled PowerShell Script Execution

  • Context: An automated daily backup script runs via Task Scheduler using powershell.exe. The script dynamically constructs a JSON payload where a specific “subject” field is intentionally left empty (null) to indicate no new data, triggering the YARA signature.
  • Filter/Exclusion: Create an exclusion for processes where the command line contains -Command or .ps1 extensions and the parent process is TaskScheduler.exe.
    • Logic: ProcessName == "powershell.exe" AND CommandLine CONTAINS ".ps1" AND ParentProcessName == "TaskScheduler.exe"

• Scenario: Microsoft Defender for Endpoint (MDE) Telemetry Upload

  • Context: The MDE sensor (SenseBrokerService.exe) periodically uploads telemetry data to the cloud. During specific health checks, it generates a null subject header in its internal communication protocol, which mimics the hatman_nullsub signature.
  • Filter/Exclusion: Exclude events originating from Microsoft-signed binaries running under the Microsoft Defender Antivirus Service service account.
    • Logic: ProcessName IN ("SenseBrokerService.exe", "MsMpEng.exe") AND Publisher == "Microsoft Corporation"

• Scenario: Azure AD Connect Synchronization

  • Context: The Azure AD Connect sync engine (miisclient.exe) runs a delta cycle. When processing attributes that have no value for specific users, it writes a null subject entry to the local log file, triggering the rule.
  • Filter/Exclusion: Exclude processes running under the ADSync service account or located in the standard installation path (`C:\Program Files\Microsoft