hatman setstatus

Hunt Hypothesis

This hunt targets adversaries leveraging the Hatman malware to manipulate process states via the setstatus function, potentially indicating an attempt to evade detection or establish persistence within a compromised host. Proactively hunting for this behavior in Azure Sentinel is critical because low-severity signals from YARA rules can be easily overlooked, yet they often represent early-stage indicators of sophisticated campaigns that require deeper context before escalating to high-priority alerts.

YARA Rule

rule hatman_setstatus : hatman {
    strings:
        $preset     = { 80 00 40 3c  00 00 62 80  40 00 80 3c  40 20 03 7c 
                        ?? ?? 82 40  04 00 62 80  60 00 80 3c  40 20 03 7c 
                        ?? ?? 82 40  ?? ?? 42 38                           }
    condition:
        $preset
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the hatman_setstatus detection rule in an enterprise environment, along with suggested filters or exclusions:

• Antivirus Policy Updates via Group Policy Objects (GPO)

  • Scenario: The endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender) pushes a scheduled policy update that modifies the status of specific security modules. This often triggers hatman_setstatus when the GPO client (gpupdate.exe) invokes the agent to refresh its operational state from “Pending” to “Active.”
  • Filter/Exclusion: Exclude processes where the parent process is gpsvc.exe or svchost.exe (specifically the GroupPolicyClient service) and the command line contains keywords like /gpo, /policyupdate, or specific GPO GUIDs associated with security baselines.

• Patch Management Deployment Windows

  • Scenario: During a scheduled maintenance window, patch management tools like Ivanti Neurons, SCCM (MECM), or ManageEngine Patch Manager execute scripts to verify agent health before deploying updates. These tools frequently call the hatman_setstatus function to mark agents as “Ready for Patching” or “Maintenance Mode,” which mimics a status change event.
  • Filter/Exclusion: Create an exclusion based on the process path belonging to known patch management binaries (e.g., C:\Program Files\Ivanti\..., C:\Windows\CCM\) and restrict the alert to specific time windows (e.g., 02:00–04:00 UTC) where maintenance jobs are known to run.

• Configuration Management Tool Reconciliation

  • Scenario: Infrastructure as Code tools such as Ansible, Chef, or Puppet perform routine configuration drift detection