Chromium Browser Headless Execution To Mockbin Like Site

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•0

Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).