Shadow Token via Remote Debug: headless browser launched with debugging port
Detects instances where Chrome or Microsoft Edge are launched in headless mode with remote debugging enabled. This configuration exposes the browser's debugging interface, typically on port 9222, which can be leveraged by attackers for browser exploitation, data exfiltration, or persistence within the browser context.
Microsoft Sentinel (KQL)
