Potential HawkEyes Stealer Infection

[rule]
description = """
Identifies the use of a browser to perform browser or internet location discovery from an unusual process. HawKEyes
infostealer performs this action to assess potential targets.
"""
id = "583448c6-986f-412b-8947-e3895bfc9426"
license = "Elastic License v2"
name = "Potential HawkEyes Stealer Infection"
os_list = ["windows"]
reference = ["https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkeye_keylogger"]
version = "1.0.19"

query = '''
process where event.action == "start" and
 process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe") and
 process.args : "--dump-dom" and process.args : "--headless" and process.args : "http*" and
 process.parent.executable != null and
 not process.parent.executable : 
                   ("?:\\Program Files\\*\\Endpoint Protection SDK\\endpointprotection.exe", 
                    "?:\\Program Files (x86)\\*\\Endpoint Protection SDK\\endpointprotection.exe",
                    "?:\\ProgramData\\CentraStage\\AEMAgent\\RMM.AdvancedThreatDetection\\dattoav\\Endpoint Protection SDK\\endpointprotection.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1016"
name = "System Network Configuration Discovery"
reference = "https://attack.mitre.org/techniques/T1016/"
[[threat.technique.subtechnique]]
id = "T1016.001"
name = "Internet Connection Discovery"
reference = "https://attack.mitre.org/techniques/T1016/001/"



[threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[internal]
min_endpoint_version = "7.15.0"