huntrule

Windows Process Creation: Headless Chromium Download via dump-dom

Flags headless Chromium browser executions using dump-dom and an http URL on Windows, indicative of stealthy remote content retrieval.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Sreeman, Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-01-04
Updated
2026-07-31
AnalysisDetection
title: "Windows Process Creation: Headless Chromium Download via dump-dom"
id: 8dad5640-b893-44a2-898d-5edd7f67ce1c
related:
  - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c
    type: derived
  - id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
    type: derived
status: test
description: This rule flags Windows process executions of Chromium-based browsers (Brave, Chrome, Edge, Opera, Vivaldi) when invoked with headless mode and the "dump-dom" command-line behavior targeting an HTTP URL. Attackers can use headless browsers to automate web retrieval and exfiltration with reduced user interaction. It relies on process creation telemetry, matching the executable path/name and specific command-line arguments including "--headless", "dump-dom", and "http".
references:
  - https://twitter.com/mrd0x/status/1478234484881436672?s=12
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml
author: Sreeman, Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2025-10-07
tags:
  - attack.command-and-control
  - attack.stealth
  - attack.t1105
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \msedge.exe
      - \opera.exe
      - \vivaldi.exe
    CommandLine|contains|all:
      - --headless
      - dump-dom
      - http
  filter_optional_edge_1:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\Edge\Application\
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files (x86)\Microsoft\EdgeWebView\
      - C:\Program Files\Microsoft\Edge\Application\
      - C:\Program Files\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeWebView\
      - C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
      - \MicrosoftEdge.exe
    CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom
  filter_optional_edge_2:
    Image|contains:
      - \AppData\Local\Microsoft\WindowsApps\
      - \Windows\SystemApps\Microsoft.MicrosoftEdge
    Image|endswith:
      - \msedge.exe
      - \MicrosoftEdge.exe
    CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml
license: DRL-1.1