Windows: Headless Chromium File Download via dump-dom in Browser (Brave/Chrome/Edge/Opera/Vivaldi)

title: "Windows: Headless Chromium File Download via dump-dom in Browser (Brave/Chrome/Edge/Opera/Vivaldi)"
id: 8dad5640-b893-44a2-898d-5edd7f67ce1c
related:
  - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c
    type: derived
  - id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
    type: derived
status: test
description: This rule identifies process creations where a Chromium-based browser is launched in headless mode with the dump-dom command line arguments and includes an HTTP URL. Attackers can use headless browsers to quietly fetch remote content and extract page data or trigger file retrieval without a visible UI. It relies on Windows process creation telemetry, matching browser image paths and specific command-line substrings for --headless, dump-dom, and http, while excluding common Microsoft Edge variants with fully specified headless flags.
references:
  - https://twitter.com/mrd0x/status/1478234484881436672?s=12
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml
author: Sreeman, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2025-10-07
tags:
  - attack.command-and-control
  - attack.stealth
  - attack.t1105
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \msedge.exe
      - \opera.exe
      - \vivaldi.exe
    CommandLine|contains|all:
      - --headless
      - dump-dom
      - http
  filter_optional_edge_1:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\Edge\Application\
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files (x86)\Microsoft\EdgeWebView\
      - C:\Program Files\Microsoft\Edge\Application\
      - C:\Program Files\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeWebView\
      - C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
      - \MicrosoftEdge.exe
    CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom
  filter_optional_edge_2:
    Image|contains:
      - \AppData\Local\Microsoft\WindowsApps\
      - \Windows\SystemApps\Microsoft.MicrosoftEdge
    Image|endswith:
      - \msedge.exe
      - \MicrosoftEdge.exe
    CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml
license: DRL-1.1