hatman origcode

Hunt Hypothesis

This detection identifies potential malicious activity by analyzing original code signatures using the Hatman YARA rule to uncover known threat patterns within Azure Sentinel. Proactive hunting for this behavior is essential to validate the accuracy of low-severity alerts and ensure that subtle indicators of compromise are not overlooked before they escalate into larger incidents.

YARA Rule

rule hatman_origcode : hatman {
    meta:
        id = "75acf3a2-0e9b-5280-8830-211c0f46737f"
    strings:
        $ocode_be   = { 3c 00 00 03  60 00 a0 b0  7c 09 03 a6  4e 80 04 20 }
        $ocode_le   = { 03 00 00 3c  b0 a0 00 60  a6 03 09 7c  20 04 80 4e }
    condition:
        $ocode_be or $ocode_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the hatman_origcode detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Build Pipeline Execution

  • Context: CI/CD pipelines (e.g., Jenkins, GitHub Actions) frequently download source archives or execute build scripts that modify original code files on the agent. The YARA rule may flag these temporary modifications as suspicious “origcode” changes during the compilation phase.
  • Filter/Exclusion: Exclude processes running under specific CI service accounts (e.g., Jenkins, GitHub Actions Runner) and restrict detection to non-build directories (excluding paths like /var/lib/jenkins/workspace or C:\build\artifacts).

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint Protection platforms (such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec) often update their signature databases by writing new code modules to the original installation directory. This triggers the rule when the AV engine writes to its own origcode folder during scheduled maintenance windows.
  • Filter/Exclusion: Create a whitelist exclusion for the specific AV service executables (e.g., C:\Program Files\CrowdStrike\fsqa.exe, MsMpEng.exe) and limit rule triggering to business hours only, or exclude known update paths like C:\ProgramData\McAfee.

• Scenario: Enterprise Software Patching via Configuration Management

  • Context: Automated patch management tools (e.g., SCCM/MECM, Ansible, Puppet) push updates to critical enterprise applications (like Office 365 or SAP). These tools often replace original binaries with patched versions, causing the YARA rule to detect a change in the origcode hash that mimics a potential tampering event.