Windows Process Creation: Headless Chromium Download via dump-dom
Flags headless Chromium browser executions using dump-dom and an http URL on Windows, indicative of stealthy remote content retrieval.
- Product
- windows
- Category
- process_creation
- Author
- Sreeman, Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-04
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process executions of Chromium-based browsers (Brave, Chrome, Edge, Opera, Vivaldi) when invoked with headless mode and the "dump-dom" command-line behavior targeting an HTTP URL. Attackers can use headless browsers to automate web retrieval and exfiltration with reduced user interaction. It relies on process creation telemetry, matching the executable path/name and specific command-line arguments including "--headless", "dump-dom", and "http".
Reporting behind it
- twitter.comhttps://twitter.com/mrd0x/status/1478234484881436672?s=12
- trendmicro.comhttps://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Headless Chromium Download via dump-dom"
id: 8dad5640-b893-44a2-898d-5edd7f67ce1c
related:
- id: ef9dcfed-690c-4c5d-a9d1-482cd422225c
type: derived
- id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
type: derived
status: test
description: This rule flags Windows process executions of Chromium-based browsers (Brave, Chrome, Edge, Opera, Vivaldi) when invoked with headless mode and the "dump-dom" command-line behavior targeting an HTTP URL. Attackers can use headless browsers to automate web retrieval and exfiltration with reduced user interaction. It relies on process creation telemetry, matching the executable path/name and specific command-line arguments including "--headless", "dump-dom", and "http".
references:
- https://twitter.com/mrd0x/status/1478234484881436672?s=12
- https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml
author: Sreeman, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2025-10-07
tags:
- attack.command-and-control
- attack.stealth
- attack.t1105
- attack.t1564.003
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \brave.exe
- \chrome.exe
- \msedge.exe
- \opera.exe
- \vivaldi.exe
CommandLine|contains|all:
- --headless
- dump-dom
- http
filter_optional_edge_1:
Image|startswith:
- C:\Program Files (x86)\Microsoft\Edge\Application\
- C:\Program Files (x86)\Microsoft\EdgeCore\
- C:\Program Files (x86)\Microsoft\EdgeWebView\
- C:\Program Files\Microsoft\Edge\Application\
- C:\Program Files\Microsoft\EdgeCore\
- C:\Program Files\Microsoft\EdgeWebView\
- C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge
Image|endswith:
- \msedge.exe
- \msedgewebview2.exe
- \MicrosoftEdge.exe
CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom
filter_optional_edge_2:
Image|contains:
- \AppData\Local\Microsoft\WindowsApps\
- \Windows\SystemApps\Microsoft.MicrosoftEdge
Image|endswith:
- \msedge.exe
- \MicrosoftEdge.exe
CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom
condition: selection and not 1 of filter_optional_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml
license: DRL-1.1