hatman origaddr

Hunt Hypothesis

This detection identifies potential Hatman malware activity by analyzing original address indicators within network traffic using a specialized YARA signature. A proactive hunt is essential to uncover early-stage lateral movement or command-and-control communications that may evade standard threshold-based alerts in Azure Sentinel due to the rule’s low severity classification.

YARA Rule

rule hatman_origaddr : hatman {
    meta:
        id = "b37364d4-928d-556b-9515-9bb944befe8a"
    strings:
        $oaddr_be   = { 3c 60 00 03  60 63 96 f4  4e 80 00 20 }
        $oaddr_le   = { 03 00 60 3c  f4 96 63 60  20 00 80 4e }
    condition:
        $oaddr_be or $oaddr_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_origaddr detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Patch Deployment via WSUS/SCCM

  • Context: The System Center Configuration Manager (SCCM) or Windows Server Update Services (WSUS) server initiates a mass deployment of security patches. During the installation phase, the hatman_origaddr logic may flag the network traffic originating from the patch distribution point as suspicious due to high-volume outbound connections to multiple client subnets that mimic command-and-control behavior.
  • Filter/Exclusion: Create an exclusion based on the source IP range of the SCCM Site Server (e.g., 10.20.5.10) and the specific process name (ccmsetup.exe or wuauserv). Additionally, exclude traffic during known maintenance windows (e.g., Tuesday 02:00–04:00 UTC).

• Scenario: Cloud Backup Agent Heartbeats

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik run scheduled jobs where the local agent communicates with the cloud repository. The hatman_origaddr rule might misinterpret the periodic heartbeat and metadata synchronization traffic as an anomalous origin address, especially if the backup agent connects to a dynamic pool of public IP addresses rather than a static one.
  • Filter/Exclusion: Implement a whitelist for known backup vendor domains (e.g., *.veeam.com, *.rubrik.com) and exclude processes matching VeeamAgent.exe or RubrikAgent. Configure the rule to ignore traffic where the destination port is standard HTTPS (443) during non-business hours.

• Scenario: SIEM Log Forwarding from Distributed Agents

  • Context: