DestructiveTargetCleaningTool6

Hunt Hypothesis

This detection identifies adversary behavior involving the execution of destructive cleaning tools that may indicate an attempt to sanitize system artifacts or remove forensic evidence post-compromise. Proactively hunting for this activity in Azure Sentinel is critical because early identification of these sanitization actions can reveal hidden lateral movement or exfiltration phases before they escalate into high-severity incidents.

YARA Rule

rule DestructiveTargetCleaningTool6
{
	strings:
		$MCU_INF_StartHexDec = {010346080A30D63633000B6263750A5052322A00103D1B570A30E67F2A00130952690A503A0D2A000E00A26E15104556766572636C7669642E657865}
		$MCU_INF_StartHexEnc = {6C3272386958BF075230780A0A54676166024968790C7A6779588F5E47312739310163615B3D59686721CF5F2120263E1F5413531F1E004543544C55}
	
	condition:
		$MCU_INF_StartHexEnc or $MCU_INF_StartHexDec
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the DestructiveTargetCleaningTool6 detection rule, tailored for an enterprise environment:

• Scenario: Enterprise Endpoint Management Agent Maintenance

  • Context: The Microsoft Intune or Jamf Pro agent performs a scheduled “Disk Cleanup” task on user endpoints every Sunday at 02:00 AM. This process invokes the native cleanmgr.exe utility with elevated privileges to remove temporary files and old update packages, matching the YARA signature for destructive cleaning tools.
  • Suggested Filter/Exclusion: Exclude processes originating from the specific service account (e.g., NT SERVICE\IntuneManagement) or filter by the parent process name (Microsoft.Intune.Management.Agent.exe). Additionally, exclude file paths located strictly within known system maintenance directories like %WINDIR%\Temp and %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files.

• Scenario: Automated Log Rotation and Archiving Job

  • Context: A centralized logging solution (e.g., Splunk Universal Forwarder or Datadog Agent) executes a nightly maintenance script (logrotate.sh or dd-agent-maintenance.cmd) to compress and delete local log files older than 30 days. This activity triggers the rule due to the high volume of file deletion operations performed by the cleaning utility component within the agent.
  • Suggested Filter/Exclusion: Create an exclusion for the specific executable hash of the logging agent’s maintenance binary (e.g., splunk-forwarder-maintenance.exe or datadog-agent.exe). Furthermore, restrict the alert to only trigger if the target files being cleaned are outside of critical application directories (excluding paths starting with /var/log/, C:\ProgramData\Logs\, or D:\Archive\).

• **Scenario: Database Maintenance and Temp Table