hatman loadoff

Hunt Hypothesis

This detection identifies adversary activity associated with the Hatman malware’s “loadoff” module, which typically indicates an initial foothold or lateral movement phase within a compromised host. Proactively hunting for this behavior in Azure Sentinel is critical to validate low-severity alerts against known benign processes and uncover potential stealthy infections that may have bypassed standard signature-based defenses.

YARA Rule

rule hatman_loadoff : hatman {
    strings:
        $loadoff_be = { 80 60 00 04  48 00 ?? ??  70 60 ff ff  28 00 00 00
                        40 82 ?? ??  28 03 00 00  41 82 ?? ??              }
        $loadoff_le = { 04 00 60 80  ?? ?? 00 48  ff ff 60 70  00 00 00 28 
                        ?? ?? 82 40  00 00 03 28  ?? ?? 82 41              }
    condition:
        $loadoff_be or $loadoff_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_loadoff detection rule, along with recommended filters or exclusions tailored for an enterprise environment:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents periodically execute package installations that involve loading custom DLLs into the hatman process context. This often occurs during off-hours maintenance windows when the deployment engine injects code to manage load balancing configurations for new application updates.
  • Filter/Exclusion: Create a whitelist rule excluding events where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the target path matches the standard software distribution folder (e.g., C:\Windows\CCMCache\*).

• Scenario: Scheduled Antivirus Real-Time Scanning

  • Context: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike or Symantec Endpoint Protection perform deep heuristic scans on the hatman executable. During these scans, the antivirus engine loads the hatman binary into memory to analyze its structure, triggering the YARA rule’s load-off signature even though no malicious activity is occurring.
  • Filter/Exclusion: Exclude alerts where the initiating process belongs to known security vendors (e.g., csagent.exe, Symantec Antivirus.exe) and the event type indicates a “File System Scan” or “Real-Time Protection” action rather than an application launch.

• Scenario: Windows Update Service Maintenance

  • Context: The Windows Update service (wuauserv) frequently triggers background tasks that load configuration modules into the hatman process to verify system integrity and apply cumulative updates. This is particularly common on domain-joined servers where Group Policy enforces automatic update checks every 2