[rule]
description = """
Identifies the use of a browser to perform browser or internet location discovery from an unusual process. HawKEyes
infostealer performs this action to assess potential targets.
"""
id = "583448c6-986f-412b-8947-e3895bfc9426"
license = "Elastic License v2"
name = "Potential HawkEyes Stealer Infection"
os_list = ["windows"]
reference = ["https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkeye_keylogger"]
version = "1.0.19"
query = '''
process where event.action == "start" and
process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe") and
process.args : "--dump-dom" and process.args : "--headless" and process.args : "http*" and
process.parent.executable != null and
not process.parent.executable :
("?:\\Program Files\\*\\Endpoint Protection SDK\\endpointprotection.exe",
"?:\\Program Files (x86)\\*\\Endpoint Protection SDK\\endpointprotection.exe",
"?:\\ProgramData\\CentraStage\\AEMAgent\\RMM.AdvancedThreatDetection\\dattoav\\Endpoint Protection SDK\\endpointprotection.exe")
'''
min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"
[[threat.technique.subtechnique]]
id = "T1016.001"
name = "Internet Connection Discovery"
reference = "https://attack.mitre.org/techniques/T1016/001/"
[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[internal]
min_endpoint_version = "7.15.0"