Anti-Idle and Mouse-Jiggling Tooling on Employee Endpoints

Devices and accounts that ran an anti-idle tool on five or more distinct days in the last 90 days.

let AntiIdleTools = dynamic(["caffeine.exe", "caffeine64.exe", "mousejiggler.exe", "movemouse.exe", "owly"]);
// optional: keep-awake tools that developers and presenters also run
let CommonKeepAwake = dynamic(["PowerToys.Awake.exe", "caffeinate", "Amphetamine", "KeepingYouAwake"]);
DeviceProcessEvents
| where Timestamp > ago(90d)
| where FileName in~ (AntiIdleTools)
     // optional: keep-awake tools that developers and presenters also run
     or FileName in~ (CommonKeepAwake)
| summarize Executions = count(), ActiveDays = dcount(bin(Timestamp, 1d)),
            Tools = make_set(FileName), LastSeen = max(Timestamp)
        by DeviceName, AccountName
| where ActiveDays >= 5
| sort by ActiveDays desc

Hosts and users that ran an anti-idle tool on five or more distinct days in the last 90 days.

```sourcetype placeholders: index=endpoint with Sysmon or EDR process events (process_name, host, user)```
```optional: the second IN list is keep-awake tools that developers and presenters also run```
index=endpoint earliest=-90d (process_name IN ("caffeine.exe", "caffeine64.exe", "mousejiggler.exe", "movemouse.exe", "owly") OR process_name IN ("PowerToys.Awake.exe", "caffeinate", "Amphetamine", "KeepingYouAwake"))
| eval day=strftime(_time, "%Y-%m-%d")
| stats count AS executions dc(day) AS active_days values(process_name) AS tools max(_time) AS last_seen BY host, user
| where active_days>=5
| sort 0 - active_days
| convert ctime(last_seen)

A single execution of an anti-idle or keep-awake tool, meant to be counted per device by the SIEM.

title: Anti-Idle or Mouse-Jiggling Utility Executed on an Employee Endpoint
id: c3a7f0b4-92d1-4e58-8a36-5d1b7e90f2a6
status: experimental
description: >
  Detects utilities whose only function is to keep a host awake and an account
  showing as present. Mandiant reports Caffeine used by DPRK IT workers to
  remain active across several laptops and profiles simultaneously; DTEX names
  caffeine.exe on Windows and owly on macOS. One execution is ordinary; report
  devices that run one on five or more distinct days.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat
  - https://www.dtex.ai/resources/i3-threat-advisory-inside-the-dprk/
logsource:
  category: process_creation
detection:
  selection_anti_idle:
    Image|endswith:
      - '\caffeine.exe'
      - '\caffeine64.exe'
      - '\MouseJiggler.exe'
      - '\MoveMouse.exe'
      - '/owly'
  # optional: keep-awake tools that developers and presenters also run
  selection_common:
    Image|endswith:
      - '\PowerToys.Awake.exe'
      - '/caffeinate'
      - '/Amphetamine'
      - '/KeepingYouAwake'
  condition: 1 of selection_*
falsepositives:
  - Users running long builds, renders, transfers or presentations who do not want the screen to lock
level: low

Hosts and users that ran an anti-idle tool on five or more distinct days in the last 90 days.

FROM logs-endpoint.events.process-*
| WHERE @timestamp > NOW() - 90 days
| EVAL tool = TO_LOWER(process.name)
| WHERE tool IN ("caffeine.exe", "caffeine64.exe", "mousejiggler.exe", "movemouse.exe", "owly") OR tool IN ("powertoys.awake.exe", "caffeinate", "amphetamine", "keepingyouawake")
| EVAL day = DATE_TRUNC(1 day, @timestamp)
| STATS executions = COUNT(*), active_days = COUNT_DISTINCT(day), tools = VALUES(process.name), last_seen = MAX(@timestamp) BY host.name, user.name
| WHERE active_days >= 5
| SORT active_days DESC
| LIMIT 200

Devices and users that ran an anti-idle tool on five or more distinct days in the last 90 days.

#event_simpleName=ProcessRollup2
| in(field=FileName, values=["caffeine.exe", "caffeine64.exe", "mousejiggler.exe", "movemouse.exe", "owly"], ignoreCase=true)
  // optional: keep-awake tools that developers and presenters also run
  or in(field=FileName, values=["PowerToys.Awake.exe", "caffeinate", "Amphetamine", "KeepingYouAwake"], ignoreCase=true)
| formatTime("%Y-%m-%d", field=@timestamp, as=day)
| groupBy([aid, ComputerName, UserName], function=[count(as=executions), count(day, distinct=true, as=active_days), collect(FileName), max(@timestamp, as=last_seen)])
| active_days >= 5
| sort(active_days, order=desc)

Hosts and users that ran an anti-idle tool on five or more distinct days in the last 90 days.

dataset = xdr_data
| filter event_type = ENUM.PROCESS
| alter tool = lowercase(action_process_image_name)
| filter tool in ("caffeine.exe", "caffeine64.exe", "mousejiggler.exe", "movemouse.exe", "owly")
    // optional: keep-awake tools that developers and presenters also run
    or tool in ("powertoys.awake.exe", "caffeinate", "amphetamine", "keepingyouawake")
| bin _time span = 1d
| comp count() as executions, count_distinct(_time) as active_days, values(tool) as tools by agent_hostname, actor_effective_username
| filter active_days >= 5
| sort desc active_days

Anti-idle and keep-awake processes running now, on Windows or macOS, as a point-in-time check without process telemetry.

SELECT name, path, cmdline, uid
FROM processes
WHERE lower(name) IN ('caffeine.exe', 'caffeine64.exe', 'mousejiggler.exe', 'movemouse.exe', 'owly')
   -- optional: keep-awake tools that developers and presenters also run
   OR lower(name) IN ('powertoys.awake.exe', 'caffeinate', 'amphetamine', 'keepingyouawake');