HawkEye

Hunt Hypothesis

This detection identifies potential adversary reconnaissance activities by leveraging the HawkEye YARA signature to flag specific file characteristics indicative of early-stage threat presence. Proactively hunting for this behavior in Azure Sentinel is essential because it enables the SOC team to uncover low-severity indicators that may precede more critical incidents, thereby reducing dwell time before full-scale exploitation occurs.

YARA Rule

rule HawkEye : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2015/06"
		ref = "http://malwareconfig.com/stats/HawkEye"
		maltype = "KeyLogger"
		filetype = "exe"

	strings:
		$key = "HawkEyeKeylogger" wide
		$salt = "099u787978786" wide
		$string1 = "HawkEye_Keylogger" wide
		$string2 = "holdermail.txt" wide
		$string3 = "wallet.dat" wide
		$string4 = "Keylog Records" wide
        $string5 = "<!-- do not script -->" wide
        $string6 = "\\pidloc.txt" wide
        $string7 = "BSPLIT" wide
        

	condition:
		$key and $salt and all of ($string*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the HawkEye detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Endpoint Protection Agent Self-Updates

  • Context: The HawkEye YARA rule likely flags executable drops or memory injections. When CrowdStrike Falcon or Microsoft Defender for Endpoint performs a scheduled signature database update (e.g., every Tuesday at 02:00 AM), the agent process (C:\Program Files\CrowdStrike\fsagent.exe) may inject code into its own service to apply patches, triggering the rule.
  • Suggested Filter: Exclude processes where ParentImage is the specific EDR agent binary AND CommandLine contains keywords like “update”, “signature”, or “delta”. Additionally, whitelist the known hash of the agent’s updater module.

• Scenario: Enterprise Software Deployment via SCCM

  • Context: During a mass deployment window, Microsoft Endpoint Configuration Manager (MECM/SCCM) executes software installation packages. The ccmexec.exe service often extracts installers to temporary folders (C:\Windows\CCMCache) and launches setup executables that match the HawkEye pattern for “suspicious executable execution from temp directories.”
  • Suggested Filter: Create an exclusion for processes launched by ccmexec.exe where the file path starts with C:\Windows\CCMCache. Furthermore, add a filter to ignore events occurring during the defined maintenance window (e.g., 01:00–05:00 UTC) if the rule is time-sensitive.

• Scenario: Automated Backup and Archiving Jobs

  • Context: Scheduled backup tasks using Veeam Agent for Windows or Commvault frequently create temporary archives, compress data, and execute scripts to verify integrity