File Download with Headless Browser

Title: File Download with Headless Browser
Status: test
Description:Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
References:
  -https://twitter.com/mrd0x/status/1478234484881436672?s=12
  -https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
Author: Sreeman, Florian Roth (Nextron Systems)
Date: 2022-01-04
modified:2025-10-07
Tags:

• -'attack.command-and-control'
• -'attack.stealth'
• -'attack.t1105'
• -'attack.t1564.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith:
      -'\brave.exe'
      -'\chrome.exe'
      -'\msedge.exe'
      -'\opera.exe'
      -'\vivaldi.exe'

    CommandLine|contains|all:
      -'--headless'
      -'dump-dom'
      -'http'

  filter_optional_edge_1:
    Image|startswith:
      -'C:\Program Files (x86)\Microsoft\Edge\Application\'
      -'C:\Program Files (x86)\Microsoft\EdgeCore\'
      -'C:\Program Files (x86)\Microsoft\EdgeWebView\'
      -'C:\Program Files\Microsoft\Edge\Application\'
      -'C:\Program Files\Microsoft\EdgeCore\'
      -'C:\Program Files\Microsoft\EdgeWebView\'
      -'C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge'

    Image|endswith:
      -'\msedge.exe'
      -'\msedgewebview2.exe'
      -'\MicrosoftEdge.exe'

    CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'
  filter_optional_edge_2:
    Image|contains:
      -'\AppData\Local\Microsoft\WindowsApps\'
      -'\Windows\SystemApps\Microsoft.MicrosoftEdge'

    Image|endswith:
      -'\msedge.exe'
      -'\MicrosoftEdge.exe'

    CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'
  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high