{"id":"ef9dcfed-690c-4c5d-a9d1-482cd422225c","title":"Browser Execution In Headless Mode","description":"Detects execution of Chromium based browser in headless mode","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-09-12","modified":"","tags":["attack.command-and-control","attack.stealth","attack.t1105","attack.t1564.003"],"technique_ids":["T1105","T1564.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/mrd0x/status/1478234484881436672?s=12","https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html"],"source_path":"rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml","source_sha256":"45c33efa86a8de595a80fde45f0c945376b5c2e40923311088927d0d131af7cc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Browser Execution In Headless Mode\nid: ef9dcfed-690c-4c5d-a9d1-482cd422225c\nrelated:\n    - id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e\n      type: derived\nstatus: test\ndescription: Detects execution of Chromium based browser in headless mode\nreferences:\n    - https://twitter.com/mrd0x/status/1478234484881436672?s=12\n    - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-09-12\ntags:\n    - attack.command-and-control\n    - attack.stealth\n    - attack.t1105\n    - attack.t1564.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\brave.exe'\n            - '\\chrome.exe'\n            - '\\msedge.exe'\n            - '\\opera.exe'\n            - '\\vivaldi.exe'\n        CommandLine|contains: '--headless'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1564.003","id":"T1564.003","name":"Hidden Window","page":"techniques/enterprise/T1564.003/"}],"data_path":"data/detection-rules/ef9dcfed-690c-4c5d-a9d1-482cd422225c.json","kind":"sigma"}