Windows Process Creation: Chromium Headless Browser Execution Targeting mockbin URLs

title: "Windows Process Creation: Chromium Headless Browser Execution Targeting mockbin URLs"
id: b1fd075f-0121-4c28-b071-38840e4ea49c
status: test
description: This rule flags process creation events where a Chromium-based browser (Brave, Chrome, Edge, Opera, or Vivaldi) is launched with the --headless flag and a command line containing mockbin-style URLs. Headless browser automation can be used to run scripts without a visible UI, including scenarios where an attacker may exfiltrate or stage data via a web service. The detection relies on Windows process creation telemetry, matching the browser executable name and specific command-line substrings for --headless and mockbin URL patterns.
references:
  - https://www.zscaler.com/blogs/security-research/steal-it-campaign
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-09-11
tags:
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \msedge.exe
      - \opera.exe
      - \vivaldi.exe
  selection_headless:
    CommandLine|contains: --headless
  selection_url:
    CommandLine|contains:
      - ://run.mocky
      - ://mockbin
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/info.yml
license: DRL-1.1
related:
  - id: 1c526788-0abe-4713-862f-b520da5e5316
    type: derived