Sigma rule: File Download with Headless Browser

Rule

Title

File Download with Headless Browser

Status

test

Level

high

Author

Sreeman, Florian Roth (Nextron Systems)

Date

2022-01-04

Modified

2025-10-07

File

rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith:
        - '\brave.exe'
        - '\chrome.exe'
        - '\msedge.exe'
        - '\opera.exe'
        - '\vivaldi.exe'
    CommandLine|contains|all:
        - '--headless'
        - 'dump-dom'
        - 'http'
filter_optional_edge_1:
    Image|startswith:
        - 'C:\Program Files (x86)\Microsoft\Edge\Application\'
        - 'C:\Program Files (x86)\Microsoft\EdgeCore\'
        - 'C:\Program Files (x86)\Microsoft\EdgeWebView\'
        - 'C:\Program Files\Microsoft\Edge\Application\'
        - 'C:\Program Files\Microsoft\EdgeCore\'
        - 'C:\Program Files\Microsoft\EdgeWebView\'
        - 'C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge'
    Image|endswith:
        - '\msedge.exe'
        - '\msedgewebview2.exe'
        - '\MicrosoftEdge.exe'
    CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'
filter_optional_edge_2:
    Image|contains:
        - '\AppData\Local\Microsoft\WindowsApps\'
        - '\Windows\SystemApps\Microsoft.MicrosoftEdge'
    Image|endswith:
        - '\msedge.exe'
        - '\MicrosoftEdge.exe'
    CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control
• attack.stealth
• attack.t1105
• attack.t1564.003

MITRE ATT&CK ids this rule names

• T1105
• T1564.003

Related rules

• ef9dcfed-690c-4c5d-a9d1-482cd422225c (derived)

References

• https://twitter.com/mrd0x/status/1478234484881436672?s=12
• https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml