Potential Data Stealing Via Chromium Headless Debugging

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•43

Detects chromium-based browsers starting in headless and debugging mode while pointing to a user profile. This behavior can be indicative of data exfiltration, specifically cookie stealing, or remote control of the browser.