Headless Chrome or Edge Launched with Remote Debugging Enabled

Kaung Khant Ko@kaungkhantko

•updated Jul 24, 2026•0•0•2

This rule detects the execution of Google Chrome or Microsoft Edge browsers in headless mode with remote debugging enabled. This configuration is often abused by attackers to interact with web sessions, bypass authentication mechanisms, or facilitate automated malicious activities by controlling the browser via the DevTools protocol.