Elastic Defend high stable eql

Potential HawkEyes Stealer Infection

Identifies the use of a browser to perform browser or internet location discovery from an unusual process. HawKEyes infostealer performs this action to assess potential targets.

View Source

Detection Logic

process where event.action == "start" and
 process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe") and
 process.args : "--dump-dom" and process.args : "--headless" and process.args : "http*" and
 process.parent.executable != null and
 not process.parent.executable : 
                   ("?:\\Program Files\\*\\Endpoint Protection SDK\\endpointprotection.exe", 
                    "?:\\Program Files (x86)\\*\\Endpoint Protection SDK\\endpointprotection.exe",
                    "?:\\ProgramData\\CentraStage\\AEMAgent\\RMM.AdvancedThreatDetection\\dattoav\\Endpoint Protection SDK\\endpointprotection.exe")

Field Validations

Loading…

Comments (0)

Loading comments...