detect HawkEye in memory

Hunt Hypothesis

This hypothesis posits that adversaries are utilizing the HawkEye tool to establish persistent in-memory footholds within Azure workloads, potentially evading traditional disk-based detection mechanisms. Proactive hunting for this behavior is critical to identify early-stage reconnaissance or lateral movement activities before they escalate into significant data exfiltration incidents.

YARA Rule

rule Hawkeye {
          meta:
            description = "detect HawkEye in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $hawkstr1 = "HawkEye Keylogger" wide
            $hawkstr2 = "Dear HawkEye Customers!" wide
            $hawkstr3 = "HawkEye Logger Details:" wide

          condition: all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• internal research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “detect HawkEye in memory” rule within an enterprise environment, including recommended filters and exclusions:

• Endpoint Security Agent Self-Scanning

  • Scenario: The organization’s primary Endpoint Detection and Response (EDR) solution, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, performs a scheduled deep memory scan. During this process, the EDR agent injects its own scanning modules into the memory space of critical system processes to verify integrity, which mimics the signature of the “HawkEye” monitoring tool being loaded.
  • Filter/Exclusion: Exclude alerts where the parent process is the specific EDR service (e.g., CrowdStrike.exe, MsMpEng.exe) or where the memory injection originates from a known security vendor’s digital signature hash.

• IT Asset Management Inventory Runs

  • Scenario: The IT department utilizes SolarWinds Service Desk or Ivanti Neurons to run nightly asset inventory jobs. These tools deploy a lightweight agent that loads into memory on all domain-joined workstations to enumerate hardware and software configurations, triggering the “HawkEye” detection logic due to similar memory footprint characteristics.
  • Filter/Exclusion: Create an exclusion rule for processes launched by the specific scheduled task name (e.g., SolarWinds-Inventory-Job) or restrict alerts to non-business hours (02:00 – 06:00) if these inventory scans are strictly off-hours.

• Software Deployment via Configuration Management

  • Scenario: The IT Operations team executes a mass software update using Microsoft SCCM (Configuration Manager) or Ansible. During the deployment phase, the management agent loads custom scripts and monitoring hooks into memory to verify installation success on target servers, which generates a signal ind