DestructiveTargetCleaningTool3

Hunt Hypothesis

This detection targets adversary post-exploitation behaviors where malicious actors deploy destructive cleaning utilities to sanitize system artifacts and evade forensic analysis within Azure Sentinel. Proactive hunting for this specific YARA signature is essential to identify early-stage cleanup activities that may precede data exfiltration or lateral movement, ensuring the SOC team can intervene before critical evidence is permanently removed.

YARA Rule

rule DestructiveTargetCleaningTool3
{
	
	strings:
		$S1_CMD_Arg = "/install" fullword
		$S2_CMD_Parse= "\"%s\"  /install \"%s\"" fullword
		$S3_CMD_Builder= "\"%s\"  \"%s\" \"%s\" %s" fullword
	
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the DestructiveTargetCleaningTool3 detection rule, including suggested filters and exclusions:

• Scenario: Automated Windows Update Cleanup via PowerShell

  • Context: A scheduled Task Scheduler job runs weekly on Domain Controllers to remove old update logs and temporary installation files using native PowerShell.exe scripts. The script invokes the Remove-Item cmdlet with recursive deletion flags, which mimics the behavior of a destructive cleaning tool.
  • Suggested Filter/Exclusion: Add an exclusion for processes originating from C:\Windows\System32\Tasks\Microsoft-Windows-Update-Cleanup where the parent process is TaskScheduler.exe and the command line contains -Command Remove-Item -Recurse.

• Scenario: Enterprise Antivirus Quarantine Maintenance

  • Context: The organization uses CrowdStrike Falcon or Symantec Endpoint Protection. Every morning at 03:00, the agent runs a maintenance routine to permanently delete files from the quarantine folder that have been flagged as “False Positive” for over 30 days. This involves the execution of falcon-sensor.exe (or equivalent) performing bulk file deletion operations.
  • Suggested Filter/Exclusion: Create a filter excluding events where the executable path matches known EDR agent binaries (e.g., C:\Program Files\CrowdStrike\*\falcon-sensor.exe) and the action is specifically “Quarantine Cleanup” or “Auto-Delete”.

• Scenario: Database Transaction Log Truncation

  • Context: The SQL Server maintenance plan executes nightly to truncate transaction logs (LDF files) for non-critical development databases. This process involves sqlservr.exe calling a specific utility (like dbcc shrinkfile) that aggressively removes unused log