detection.wiki

Detection rules › Sigma

File Download with Headless Browser

Severity
high
Author
Sreeman, Florian Roth (Nextron Systems)
Source
upstream

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1564.003 Hide Artifacts: Hidden Window
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

or:
Image|endswith: '\brave.exe'
Image|endswith: '\chrome.exe'
Image|endswith: '\msedge.exe'
Image|endswith: '\opera.exe'
Image|endswith: '\vivaldi.exe'
CommandLine|contains: --headless
CommandLine|contains: dump-dom
CommandLine|contains: http

Stage 2: not 1 of filter_optional_*

or:
or:
Image|endswith: '\MicrosoftEdge.exe'
Image|endswith: '\msedge.exe'
Image|endswith: '\msedgewebview2.exe'
or:
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeCore\'
Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeWebView\'
Image|startswith: 'C:\Program Files (x86)\Microsoft\Edge\Application\'
Image|startswith: 'C:\Program Files\Microsoft\EdgeCore\'
Image|startswith: 'C:\Program Files\Microsoft\EdgeWebView\'
Image|startswith: 'C:\Program Files\Microsoft\Edge\Application\'
Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge'
CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'
or:
Image|endswith: '\MicrosoftEdge.exe'
Image|endswith: '\msedge.exe'
or:
Image|contains: '\AppData\Local\Microsoft\WindowsApps\'
Image|contains: '\Windows\SystemApps\Microsoft.MicrosoftEdge'
CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • --headless corpus 5 (sigma 5)
  • --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom
  • dump-dom
  • http corpus 31 (sigma 31)
Imageends_with
  • \MicrosoftEdge.exe corpus 3 (sigma 3)
  • \brave.exe corpus 20 (sigma 20)
  • \chrome.exe corpus 11 (sigma 11)
  • \msedge.exe corpus 22 (sigma 22)
  • \msedgewebview2.exe corpus 15 (sigma 15)
  • \opera.exe corpus 21 (sigma 21)
  • \vivaldi.exe corpus 19 (sigma 19)
Imagematch
  • \AppData\Local\Microsoft\WindowsApps\ corpus 2 (sigma 2)
  • \Windows\SystemApps\Microsoft.MicrosoftEdge
Imagestarts_with
  • C:\Program Files (x86)\Microsoft\EdgeCore\ corpus 11 (sigma 11)
  • C:\Program Files (x86)\Microsoft\EdgeWebView\ corpus 2 (sigma 2)
  • C:\Program Files (x86)\Microsoft\Edge\Application\
  • C:\Program Files\Microsoft\EdgeCore\ corpus 11 (sigma 11)
  • C:\Program Files\Microsoft\EdgeWebView\
  • C:\Program Files\Microsoft\Edge\Application\
  • C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.