hatman origaddr

Hunt Hypothesis

This detection identifies adversary activity where malicious processes originate from unexpected network addresses, potentially indicating lateral movement or command-and-control communication attempts. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to validate legitimate traffic patterns and rapidly isolate anomalous connections before they escalate into significant security incidents.

YARA Rule

rule hatman_origaddr : hatman {
    strings:
        $oaddr_be   = { 3c 60 00 03  60 63 96 f4  4e 80 00 20 }
        $oaddr_le   = { 03 00 60 3c  f4 96 63 60  20 00 80 4e }
    condition:
        $oaddr_be or $oaddr_le
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_origaddr detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Scheduled Patch Management Deployment

  • Context: The organization uses Microsoft Endpoint Configuration Manager (MECM/SCCM) to push security updates. During the nightly maintenance window, the SCCM server initiates a mass deployment where thousands of agents simultaneously connect back to the central distribution point using their original source IP addresses to download payloads, mimicking the hatman_origaddr signature.
  • Suggested Filter: Exclude traffic originating from the specific subnet range assigned to the SCCM Distribution Points (e.g., 10.20.50.0/24) during the defined maintenance window (e.g., 02:00–06:00 UTC). Additionally, filter for process names containing ccmexec.exe or WUAUCore.

• Scenario: Enterprise Backup Agent Heartbeat

  • Context: The enterprise relies on Veeam Backup & Replication. The Veeam agents installed on critical file servers perform hourly heartbeat checks and metadata synchronization with the central management server. This consistent, legitimate communication from the original source IP to a known destination often triggers the rule as it involves standard address verification logic similar to the detection target.
  • Suggested Filter: Create an exclusion for traffic where the source process is VeeamAgent.exe or vrbroker.exe and the destination port matches the Veeam management service ports (typically 9392, 9401). Whitelist the specific IP range of the Veeam Management Server.

• Scenario: Automated Compliance Scanning by Security Tools

  • Context: A third-party vulnerability scanner, such as Tenable Nessus or **Qual