Headless Chromium Remote Debugging on macOS
Detects Chromium-family browsers on macOS launched in headless mode with a remote debugging port, enabling Chrome DevTools Protocol automation or remote browser control.
// OVERVIEW: Detects a Chromium-family browser on macOS launched headless with
// a remote debugging port, enabling Chrome DevTools Protocol automation or control.
// SOURCE HUNTPACK: AmnesiaStealer macOS ClickFix Hunt
// MITRE: T1219, T1113
// CONF: medium | FP: medium | COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2 (macOS)
// FALSE POSITIVES: Legitimate browser automation or QA using Selenium, Puppeteer, or Playwright.
// TUNING: Exclude approved CI hosts, automation accounts, and known framework parent processes.
// LOOKBACK: 14d - set with the Falcon time picker.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| FileName=/^(Google Chrome|Brave Browser|Microsoft Edge|Arc|Opera|Vivaldi|Chromium)$/i
| CommandLine=/--remote-debugging-port=[0-9]+/i
| CommandLine=/--headless/i
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine, UserName], function=count(aid, as=hits))
| sort(hits, order=desc)This query hunts for Chromium-family browsers on macOS launched headless with a Chrome DevTools Protocol remote-debugging port. This permits browser automation and can enable control of an authenticated browser session.
Source: AmnesiaStealer macOS ClickFix HuntPack.
-
Selects ProcessRollup2 and SyntheticProcessRollup2 events from macOS.
-
Restricts results to common Chromium-family browser processes.
-
Requires a numeric --remote-debugging-port argument.
-
Requires headless browser execution.
-
Groups results by host, parent, browser, command line, and user.
False positives and tuning: Selenium, Puppeteer, Playwright, QA systems, monitoring agents, and CI runners can legitimately use both flags. Baseline approved automation hosts and parents. Prioritize unexpected interactive-user endpoints and unusual parent processes.
Limitations: These flags enable CDP control but do not prove malicious activity or confirm that an operator connected. The query is limited to macOS and the listed browser process names.
