Bluekit BitM rrweb DOM Stream: Persistent Browser WebSocket Tunnel to Phishing Host

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects browser processes exhibiting a pattern consistent with 'Browser-in-the-Middle' attacks, specifically the streaming of DOM content (e.g., using rrweb) over persistent WebSocket connections to external IP addresses. The rule identifies high-density connection events to the same remote IP on port 443 lasting for more than 120 seconds and correlates these events with a preceding phishing email click on the same device.