hatman nullsub

Hunt Hypothesis

This detection identifies potential adversary activity involving the Hatman malware’s use of the NullSub technique to evade signature-based defenses within Azure Sentinel workloads. Proactively hunting for this behavior is critical because early identification of these subtle evasion mechanisms allows the SOC team to validate endpoint integrity and prevent lateral movement before more severe exploitation occurs.

YARA Rule

rule hatman_nullsub : hatman {
    strings:
        $nullsub     = { ff ff 60 38  02 00 00 44  20 00 80 4e }
    condition:
        $nullsub
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the hatman_nullsub detection rule in an enterprise environment, along with suggested filters or exclusions:

• Windows Group Policy Object (GPO) Updates

  • Scenario: During scheduled maintenance windows, Domain Controllers process GPO updates that involve modifying registry keys under HKLM\Software\Policies. The gpupdate.exe service often writes null-subject metadata to the event log while synchronizing security settings across thousands of endpoints.
  • Filter/Exclusion: Exclude events where the Process Name is gpupdate.exe and the User Account matches a known Domain Admin group (e.g., CN=Domain Admins,DC=corp,DC=com).

• Microsoft Endpoint Configuration Manager (MECM) Software Deployment

  • Scenario: When MECM (formerly SCCM) pushes large application packages or OS updates, the client agent (ccmexec.exe) performs background tasks that involve creating temporary null-subject entries to validate package integrity before installation. This is common during “Business Hours” deployment cycles.
  • Filter/Exclusion: Create a rule exclusion for processes named ccmexec.exe running under the context of the Local System account, specifically when the Parent Process is smstsvc.exe.

• Antivirus Scheduled Scans (CrowdStrike or SentinelOne)

  • Scenario: Enterprise EDR solutions like CrowdStrike (csagent.exe) or SentinelOne perform deep heuristic scans that include checking file attributes and metadata. During these scans, the engine may generate null-subject events when verifying signed binaries in protected system directories without an active interactive user session.
  • Filter/Exclusion: Filter out alerts where the Process Path contains C:\Program Files\CrowdStrike\ (or equivalent vendor paths) and the