Possible Browser Execution In Headless Mode (via process_creation)

title: Possible Browser Execution In Headless Mode (via process_creation)
id: 7df9a0b3-4499-52d9-85c3-06ecda423e98
status: stable
description: This rule detects execution of Chromium based browser in headless mode
references:
    - https://attack.mitre.org/techniques/T1564/003/
    - https://attack.mitre.org/techniques/T1105/
    - https://twitter.com/mrd0x/status/1478234484881436672?s=12
    - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
author: Huntrule Team
date: 2026-01-13
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1105
    - attack.t1564.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\msedge.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
        CommandLine|contains: '--headless'
    condition: selection
falsepositives:
    - Unknown
level: low