Download Activity via a Headless Browser

[rule]
description = """
Identifies the use of a browser to download a file from a remote URL and from a suspicious parent process. Adversaries
may use browsers to avoid ingress tool transfer restrictions.
"""
id = "e35465eb-2a6b-4b6a-abbf-0bc3d9a068d0"
license = "Elastic License v2"
name = "Download Activity via a Headless Browser"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Msedge/"]
version = "1.0.5"

query = '''
process where event.action in ("start", "already_running") and
 process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe", "vivaldi.exe") and
 (
  (process.args : "--headless*" and process.args : ("http*", "data:text/html;base64,*")) or
  process.command_line : ("*mh0dHBzOi8vd2ViaG9vay5zaXRl*", "*93ZWJob29rLnNpdGU*") or
  (process.args_count == 2 and process.args : "data:text/html;base64,*")
  ) and
  process.parent.name :
     ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "conhost.exe", "msiexec.exe",
      "explorer.exe", "rundll32.exe", "winword.exe", "excel.exe", "onenote.exe", "hh.exe", "powerpnt.exe", "forfiles.exe",
      "pcalua.exe", "wmiprvse.exe") and
  not process.args : ("http://localhost/Allure#graph",  "--print-to-pdf=*")
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.16.0"