Query: Sigma rule for Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Matching passage: Sigma rule: Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files. Logsource: windows / process_creation. Rule: title: File Download with Headless Browser id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e related: - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c type: derived status: test description: Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files references: - https://twitter.com/mrd0x/status/1478234484881436672?s=12 - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html author: Sreeman, Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2025-10-07 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains|all: - --headless - dump-dom - http filter_optional_edge_1: Image|startswith: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files (x86)\Microsoft\EdgeWebView\ - C:\Program Files\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeWebView\ - C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge Image|endswith: - \msedge.exe - \msedgewebview2.exe - \MicrosoftEdge.exe CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom filter_optional_edge_2: Image|contains: - \AppData\Local\Microsoft\WindowsApps\ - \Windows\SystemApps\Microsoft.MicrosoftEdge Image|endswith: - \msedge.exe - \MicrosoftEdge.exe CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml
Near-miss passage: Sigma rule: Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update fea. Logsource: windows / process_creation. Rule: title: Dism Remove Online Package id: 43e32da2-fdd0-4156-90de-50dfd62636f9 status: test description: Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-26---disable-windows-defender-with-dism - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html author: frack113 date: 2022-01-16 modified: 2022-08-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_dismhost: Image|endswith: \DismHost.exe ParentCommandLine|contains|all: - /Online - /Disable-Feature selection_dism: Image|endswith: \Dism.exe CommandLine|contains|all: - /Online - /Disable-Feature condition: 1 of selection_* falsepositives: - Legitimate script level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dism_remove/info.yml simulation: - type: atomic-red-team name: Disable Windows Defender with DISM technique: T1562.001 atomic_guid: 871438ac-7d6e-432a-b27d-3e7db69faf58