Suspicious Browser Started with Remote Debugging (via process_creation)

title: Suspicious Browser Started with Remote Debugging (via process_creation)
id: 34c8ee7c-23c7-56a0-928f-63f41c4463f1
status: stable
description: This rule detects browsers starting with the remote debugging flags. Which is a method frequently used to perform browser injection attacks
references:
    - https://attack.mitre.org/techniques/T1185/
    - https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf
    - https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/
    - https://github.com/defaultnamehere/cookie_crimes/
    - https://github.com/wunderwuzzi23/firefox-cookiemonster
author: Huntrule Team
date: 2026-03-08
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1185
logsource:
    category: process_creation
    product: windows
detection:
    selection_chromium_based:
        CommandLine|contains: ' --remote-debugging-'
    selection_firefox:
        Image|endswith: '\firefox.exe'
        CommandLine|contains: ' -start-debugger-server'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium