Browser Execution In Headless Mode

Title: Browser Execution In Headless Mode
Status: test
Description:Detects execution of Chromium based browser in headless mode
References:
  -https://twitter.com/mrd0x/status/1478234484881436672?s=12
  -https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-12
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.stealth'
• -'attack.t1105'
• -'attack.t1564.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith:
      -'\brave.exe'
      -'\chrome.exe'
      -'\msedge.exe'
      -'\opera.exe'
      -'\vivaldi.exe'

    CommandLine|contains: '--headless'
  condition:selection
Falsepositives:
  -Unknown
Level: low