DestructiveTargetCleaningTool7

Hunt Hypothesis

This hypothesis posits that adversaries are deploying destructive cleaning utilities to sanitize evidence or disrupt forensic analysis following an initial compromise. Proactive hunting for this behavior in Azure Sentinel is critical because early identification of these tools can reveal post-exploitation activities before they escalate into data loss or incident response delays, even when the associated severity is currently low.

YARA Rule

rule DestructiveTargetCleaningTool7
{
	strings:
		$a = "SetFilePointer"
		$b = "SetEndOfFile"
		$c = {75 17 56 ff 15 ?? ?? ?? ?? 6a 00 6a 00 6a 00 56 ff D5 56 ff 15 ?? ?? ?? ?? 56}
	
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the DestructiveTargetCleaningTool7 detection rule in an enterprise environment, along with suggested filters or exclusions:

• Windows Server Storage Optimization via sdelete

  • Scenario: System administrators frequently run the Sysinternals sdelete.exe utility on file servers to securely wipe free disk space (using the -z flag) after large data migrations. This tool performs low-level overwrite operations that mimic destructive cleaning behaviors, triggering the rule when it accesses and modifies volume metadata.
  • Suggested Filter: Exclude processes where ImageName is sdelete.exe, CommandLine contains the -z or -p flags, and the process is running under a known Service Account (e.g., DOMAIN\svc_storage_admin).

• Endpoint DLP Agent Cache Purge

  • Scenario: The enterprise Data Loss Prevention (DLP) agent (specifically Symantec Endpoint DLP or Forcepoint) executes a scheduled nightly job to purge temporary cache files and quarantine logs from the local C:\ProgramData\DLP\Cache directory. This involves deleting thousands of small files in rapid succession, which the YARA rule interprets as a targeted destructive cleaning event.
  • Suggested Filter: Create an exclusion for process paths containing \Symantec\Endpoint Protection\ or \Forcepoint\, specifically targeting executable names like DlpAgentService.exe or CacheCleaner.exe running during the maintenance window (02:00 – 04:00 local time).

• Microsoft SCCM/MECM Software Update Cleanup

  • Scenario: The System Center Configuration Manager (SCCM) client service runs a “Software Updates” cleanup task to remove expired update packages and temporary installation files from the `C:\Windows\CCMCache