hatman mftmsr

Hunt Hypothesis

This detection targets adversary behavior involving the execution of the Hatman MFTMSR module, which often indicates reconnaissance or data staging activities within the environment. Proactively hunting for this signature in Azure Sentinel is critical to identify early-stage lateral movement or file transfer operations that may precede more significant exfiltration events.

YARA Rule

rule hatman_mftmsr : hatman {
    strings:
        $mfmsr_be   = { 7c 63 00 a6 }
        $mfmsr_le   = { a6 00 63 7c }
        $mtmsr_be   = { 7c 63 01 24 }
        $mtmsr_le   = { 24 01 63 7c }
    condition:
        ($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_mftmsr detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Enterprise Data Loss Prevention (DLP) Scanning

  • Context: The rule triggers when the Symantec DLP Agent or Microsoft Purview Information Protection service scans large file repositories on endpoints. These agents often inject memory modules into user sessions to inspect MFT (Microsoft File Transfer) streams, mimicking the behavior of malicious data exfiltration tools.
  • Filter/Exclusion: Add an exclusion for processes running under Symantec DLP Agent.exe and MsInfoProtectionService.exe. Additionally, filter out events where the parent process is svchost.exe with the service name containing “Dlp” or “InformationProtection”.

• Scenario: Scheduled Backup Jobs via Veeam or Commvault

  • Context: During nightly backup windows, enterprise backup agents (e.g., Veeam Agent for Windows or Commvault Simpana) utilize MFT protocols to stage data before transmission. The YARA rule detects the high-volume file transfer and specific memory signatures used by these backup engines as a potential “man-in-the-middle” or unauthorized transfer attempt.
  • Filter/Exclusion: Create a time-based filter to suppress alerts between 02:00 and 06:00 UTC for processes named VeeamAgent.exe and siman.exe. Alternatively, exclude file paths located within standard backup staging directories (e.g., C:\ProgramData\Veeam\Backup\Staging).

• Scenario: Patch Management Deployment via SCCM or Intune

  • Context: When System Center Configuration Manager (SCCM) or Microsoft Intune pushes large software updates, the deployment client (ccmexec.exe or `Int