Detects Hatman malware | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies the presence of Hatman malware by monitoring for its specific behavioral signatures within the Azure Sentinel environment. Proactive hunting is essential to uncover early-stage infections that may evade standard alerts, allowing the SOC team to mitigate potential data exfiltration or lateral movement before the threat escalates.

YARA Rule

rule hatman_payload : hatman {
    meta:
        description = "Detects Hatman malware"
        reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
        date = "2017/12/19"
        author = "DHS/NCCIC/ICS-CERT"
        id = "9ef57fca-a536-5937-8510-b410f735a73e"
    condition:
        ( hatman_memcpy and hatman_origcode and hatman_mftmsr ) and not ( hatman_origaddr and hatman_loadoff )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

References

False Positive Guidance

Here are 5 specific false positive scenarios for the “Detects Hatman malware” rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario: Antivirus Engine Scanning via Scheduled Task
- Context: The enterprise’s endpoint protection suite (e.g., Microsoft Defender or CrowdStrike) runs a full system scan during off-hours. The Hatman detection logic may flag the scanning process itself as suspicious behavior if it involves specific file modifications or registry writes typical of the malware’s C2 mechanism.
- Suggested Filter/Exclusion: Create an exclusion rule for the specific service executable (e.g., MsMpEng.exe or csagent.exe) when running under the “SYSTEM” account during the defined maintenance window (e.g., 02:00–04:00 UTC). Exclude process hashes known to be part of the AV engine.
Scenario: Deployment of Patched Applications via Configuration Management
- Context: Automated deployment tools like SCCM or Ansible push updates to a large group of workstations. These tools often install new binaries and modify registry keys in a manner that mimics Hatman’s persistence techniques, triggering the detection logic on the newly installed files.
- Suggested Filter/Exclusion: Exclude alerts generated by processes running under the “Configuration Manager Client” (ccmexec.exe) or specific deployment service accounts (e.g., DOMAIN\DeploySvc). Additionally, whitelist file paths located in standard software update directories such as C:\Program Files\Microsoft Update or C:\Windows\System32\ccm.
Scenario: Backup Agent Performing File Integrity Checks
- Context: Enterprise backup solutions (e.g., Veeam or Commvault) perform nightly integrity checks and incremental backups. The agent frequently reads, locks, and writes metadata to user profiles and system