{"id":"0e8cfe08-02c9-4815-a2f8-0d157b7ed33e","title":"File Download with Headless Browser","description":"Detects execution of chromium based browser in headless mode using the \"dump-dom\" command line to download files","author":"Sreeman, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-04","modified":"2025-10-07","tags":["attack.command-and-control","attack.stealth","attack.t1105","attack.t1564.003"],"technique_ids":["T1105","T1564.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/mrd0x/status/1478234484881436672?s=12","https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html"],"source_path":"rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml","source_sha256":"7f30d6941da81043db300c87d6cb5403aef1a94cd0065254c1a172104d2b3313","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: File Download with Headless Browser\nid: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e\nrelated:\n    - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c\n      type: derived\nstatus: test\ndescription: Detects execution of chromium based browser in headless mode using the \"dump-dom\" command line to download files\nreferences:\n    - https://twitter.com/mrd0x/status/1478234484881436672?s=12\n    - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html\nauthor: Sreeman, Florian Roth (Nextron Systems)\ndate: 2022-01-04\nmodified: 2025-10-07\ntags:\n    - attack.command-and-control\n    - attack.stealth\n    - attack.t1105\n    - attack.t1564.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\brave.exe'\n            - '\\chrome.exe'\n            - '\\msedge.exe'\n            - '\\opera.exe'\n            - '\\vivaldi.exe'\n        CommandLine|contains|all:\n            - '--headless'\n            - 'dump-dom'\n            - 'http'\n    filter_optional_edge_1:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\'\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeCore\\'\n            - 'C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\'\n            - 'C:\\Program Files\\Microsoft\\Edge\\Application\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeCore\\'\n            - 'C:\\Program Files\\Microsoft\\EdgeWebView\\'\n            - 'C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftEdge'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\msedgewebview2.exe'\n            - '\\MicrosoftEdge.exe'\n        CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'\n    filter_optional_edge_2:\n        Image|contains:\n            - '\\AppData\\Local\\Microsoft\\WindowsApps\\'\n            - '\\Windows\\SystemApps\\Microsoft.MicrosoftEdge'\n        Image|endswith:\n            - '\\msedge.exe'\n            - '\\MicrosoftEdge.exe'\n        CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","page":"techniques/enterprise/T1564.003/"}],"data_path":"data/detection-rules/0e8cfe08-02c9-4815-a2f8-0d157b7ed33e.json","kind":"sigma"}