SuperDAT

Hunt Hypothesis

This hypothesis detects adversaries leveraging custom or obfuscated payloads identified by the ‘SuperDAT’ YARA signature to evade standard signature-based detection mechanisms. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy threats that may bypass initial security controls and require deeper forensic analysis due to their low-severity classification.

YARA Rule

rule SuperDAT: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

False Positive Scenarios for “SuperDAT” Detection Rule

• Antivirus Definition Updates via Scheduled Tasks

  • Scenario: The enterprise endpoint protection suite (e.g., Microsoft Defender Antivirus or CrowdStrike Falcon) executes a nightly scheduled task to download and apply the latest definition database. This process often involves unpacking compressed archives containing signature files that match the “SuperDAT” YARA pattern, triggering an alert during the update window.
  • Filter/Exclusion: Create a time-based exclusion for the rule between 01:00 AM and 04:00 AM on weekdays, or add a process-level exclusion for specific service executables such as MsMpEng.exe (Microsoft Defender) or FalconSensorService.exe.

• Software Deployment via Configuration Management Tools

  • Scenario: During a standard patching cycle, tools like Microsoft SCCM (Configuration Manager), Ivanti Neurons, or Ansible deploy new applications to workstations. The deployment agent extracts installation packages (MSI/EXE) from a central repository, which may contain embedded DAT files matching the rule’s signature before the application is fully installed.
  • Filter/Exclusion: Exclude the specific process names of the deployment agents, such as ccmsetup.exe, TaskAgent.exe, or ansible-runner.py. Additionally, filter out events originating from known internal distribution point IP ranges (e.g., 10.x.x.x).

• System Backup and Archiving Operations

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault run daily jobs that compress and archive user data. These tools often generate temporary DAT files during the indexing phase of the backup process, which are subsequently scanned by the YARA engine before being deleted or moved to long-term storage.
  • Filter/Exclusion: Implement a file path