Tag
Suspicious File Download via Headless Browser
1 rule 2 TTPs 26 IOCsThe DUCKTAIL threat actor leverages Chromium-based web browsers (such as Microsoft Edge and Chrome) running in headless mode with the `--dump-dom` argument to stealthily download malicious content from the internet via suspicious file-sharing domains, impacting compromised endpoints.
Potential File Download via a Headless Browser
2 rules 1 TTPDetects the execution of headless browsers from suspicious parent processes with arguments indicative of scripted retrieval, bypassing application control policies and restrictions on direct download tools.
Potential File Download via a Headless Browser
2 rules 1 TTPDetects the execution of headless browsers from suspicious parent processes with arguments indicative of scripted retrieval, bypassing application control policies and restrictions on direct download tools.
Suspicious File Download via Headless Browser
2 rules 2 TTPs 26 IOCsAttackers are leveraging Chromium-based browsers in headless mode with the `--dump-dom` argument to download files from file-sharing services and direct IPs, potentially indicative of reconnaissance or malware delivery.