Windows: Chromium Headless Remote Debugging With User Profile Directory

title: "Windows: Chromium Headless Remote Debugging With User Profile Directory"
id: 222eb5e4-5434-43f5-836a-104af2634b20
related:
  - id: b3d34dc5-2efd-4ae3-845f-8ec14921f449
    type: derived
  - id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4
    type: derived
status: test
description: This rule flags Chromium-based browsers launched with headless mode and remote debugging enabled, along with a specified user data directory. Attackers commonly use this pattern to automate browser access and potentially exfiltrate or manipulate user data within the browser context. It relies on Windows process creation telemetry and matches specific command-line arguments used to enable remote debugging, headless operation, and user profile storage.
references:
  - https://github.com/defaultnamehere/cookie_crimes/
  - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password
  - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/
  - https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-23
tags:
  - attack.credential-access
  - attack.collection
  - attack.stealth
  - attack.t1185
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - --remote-debugging-
      - --user-data-dir
      - --headless
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1