Windows Chromium-Based Browsers Launched with Headless Debugging and User Profile Directory
Alerts on Windows launches of Chromium-based browsers in headless + remote debugging mode targeting a user data directory.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-23
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions where a Chromium-based browser is started with headless mode and remote debugging enabled while also specifying a user data directory. Attackers can use these flags to automate browser access, persist session data under a chosen profile, and potentially enable data collection or remote control behavior. It relies on process creation telemetry with command-line arguments containing the remote debugging, headless, and user data directory switches.
Reporting behind it
- github.comhttps://github.com/defaultnamehere/cookie_crimes/
- mango.pdf.zonehttps://mango.pdf.zone/stealing-chrome-cookies-without-a-password
- embracethered.comhttps://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/
- embracethered.comhttps://embracethered.com/blog/posts/2020/chrome-spy-remote-control/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Chromium-Based Browsers Launched with Headless Debugging and User Profile Directory
id: 222eb5e4-5434-43f5-836a-104af2634b20
related:
- id: b3d34dc5-2efd-4ae3-845f-8ec14921f449
type: derived
- id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4
type: derived
status: test
description: This rule identifies Windows process executions where a Chromium-based browser is started with headless mode and remote debugging enabled while also specifying a user data directory. Attackers can use these flags to automate browser access, persist session data under a chosen profile, and potentially enable data collection or remote control behavior. It relies on process creation telemetry with command-line arguments containing the remote debugging, headless, and user data directory switches.
references:
- https://github.com/defaultnamehere/cookie_crimes/
- https://mango.pdf.zone/stealing-chrome-cookies-without-a-password
- https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/
- https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-23
tags:
- attack.credential-access
- attack.collection
- attack.stealth
- attack.t1185
- attack.t1564.003
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- --remote-debugging-
- --user-data-dir
- --headless
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1