Hannibal Stealer default gateway MAC resolution via SendARP and iphlpapi.dll
Detects instances where CefSharp.BrowsersSubprocess.exe or processes within the SCef.WindowsAdapter folder load the iphlpapi.dll library, combined with command-line arguments indicative of network configuration discovery, such as retrieving MAC addresses, BSSIDs, or default gateways. This activity suggests potential reconnaissance by an application or a process masquerading as a browser component.
Microsoft Sentinel (KQL)
