Windows Chromium Headless Execution with Mockbin/Mocky URL
Alerts when a Chromium-based browser runs headless on Windows with a mockbin-like URL in the command line.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-11
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creations where a Chromium-based browser (brave, chrome, edge, opera, or vivaldi) is launched with the --headless flag and a command-line URL containing mocky/mockbin indicators. Attackers can use headless browsers to automate access to web endpoints for staging or data exfiltration. The detection relies on process creation telemetry, specifically the executable path/name and the full command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-chromium-headless-browser-execution-targeting-mockbin-u-1c526788
title: Windows Chromium Headless Execution with Mockbin/Mocky URL
id: b1fd075f-0121-4c28-b071-38840e4ea49c
status: test
description: This rule flags Windows process creations where a Chromium-based browser (brave, chrome, edge, opera, or vivaldi) is launched with the --headless flag and a command-line URL containing mocky/mockbin indicators. Attackers can use headless browsers to automate access to web endpoints for staging or data exfiltration. The detection relies on process creation telemetry, specifically the executable path/name and the full command line.
references:
- https://www.zscaler.com/blogs/security-research/steal-it-campaign
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-09-11
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
Image|endswith:
- \brave.exe
- \chrome.exe
- \msedge.exe
- \opera.exe
- \vivaldi.exe
selection_headless:
CommandLine|contains: --headless
selection_url:
CommandLine|contains:
- ://run.mocky
- ://mockbin
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse/info.yml
license: DRL-1.1
related:
- id: 1c526788-0abe-4713-862f-b520da5e5316
type: derived