Suspicious File Download via Headless Browser

Attackers are increasingly utilizing Chromium-based browsers such as Chrome, Edge, and Brave in headless mode to download files surreptitiously. This technique involves using the --headless and --dump-dom arguments, allowing attackers to automate browser actions without a graphical user interface. This tactic has been observed in campaigns like DUCKTAIL, where attackers used this method to download content from the internet using direct URLs or file-sharing platforms. This behavior is especially concerning because it can bypass traditional security measures that rely on user interaction. Defenders should be aware of processes spawning headless browsers and monitor for network connections to file-sharing services or unusual IP addresses.

Attack Chain

1. The attacker compromises a system through an initial access vector (e.g., spearphishing, exploit).
2. The attacker executes a Chromium-based browser (Chrome, Edge, Brave, etc.) from the command line or through a script.
3. The browser is launched with the --headless and --dump-dom arguments to run without a GUI and potentially download content.
4. The attacker uses the browser to access a URL, either a direct IP address or a file-sharing service like Mega.nz or Mediafire.com.
5. The browser downloads a file from the specified URL or domain.
6. The downloaded file may be a malicious payload, configuration file, or stolen data.
7. The attacker executes the downloaded file or uses the data for further exploitation or lateral movement.

Impact

A successful attack can lead to malware infection, data exfiltration, or further compromise of the affected system and network. The use of headless browsers makes detection more challenging, as it mimics legitimate browser activity without the visual cues of a typical user session. The number of victims and specific sectors targeted are currently unknown, but the potential for widespread impact is significant, especially if the downloaded files contain ransomware or other destructive payloads.

Recommendation

• Monitor process creation events for Chromium-based browsers (chrome.exe, msedge.exe, brave.exe) with the --headless and --dump-dom arguments using the provided Sigma rules.
• Inspect network connections from processes matching the above criteria to known file-sharing domains listed in the IOCs.
• Analyze command-line arguments of browser processes for direct IP addresses and correlate with network connection logs.
• Review the known_false_positives section in the original Splunk detection for tips on tuning the detections.