Suspicious Browser Execution via Headless or Remote Debugging Mode

Kaung Khant Ko@kaungkhantko

•updated Jul 24, 2026•3•0•4

This rule detects instances where Google Chrome or Microsoft Edge are launched with command-line arguments typical of headless operation or remote debugging (e.g., --headless=new, --remote-debugging-port, --user-data-dir). It specifically flags these executions when they are not initiated by known browser-related processes or the system shell (explorer.exe), which may indicate an attacker using the browser as a proxy or for automated data exfiltration.