Windows Process Execution of Chromium Browsers in Headless Mode

title: Windows Process Execution of Chromium Browsers in Headless Mode
id: 6885b148-b2b9-4230-86dd-c2130b36afa9
related:
  - id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
    type: derived
  - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c
    type: derived
status: test
description: This rule flags process creation of common Chromium-based browsers (Brave, Chrome, Edge, Opera, Vivaldi) when launched with the "--headless" argument. Headless browsing can be used to automate web access, evade user visibility, and support stealthy interaction with attacker-controlled infrastructure. It relies on Windows process creation telemetry, matching browser executables by filename and the presence of "--headless" in the command line.
references:
  - https://twitter.com/mrd0x/status/1478234484881436672?s=12
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-12
tags:
  - attack.command-and-control
  - attack.stealth
  - attack.t1105
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \brave.exe
      - \chrome.exe
      - \msedge.exe
      - \opera.exe
      - \vivaldi.exe
    CommandLine|contains: --headless
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1