Implement signatures for headless browser & suspicious args#549
Implement signatures for headless browser & suspicious args#549kevross33 wants to merge 2 commits intoCAPESandbox:masterfrom
Conversation
Added signatures to detect headless browser execution and suspicious browser arguments.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces new detection capabilities to identify malicious browser usage patterns. It specifically targets the execution of web browsers in headless mode and the use of suspicious command-line arguments, behaviors frequently associated with advanced persistent threats (APTs) and evasion techniques. These additions aim to enhance the system's ability to detect sophisticated cyberattack methodologies. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
kevross33
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces two new signatures for detecting headless browser execution and suspicious browser arguments, which are valuable for identifying modern evasion techniques. My review includes suggestions to improve performance and code quality by refactoring how regular expressions are compiled and used. Specifically, I recommend defining them as class attributes to avoid recompilation and simplifying the matching logic. I've also identified and suggested a fix for a typo in an MBC code.
| class ExecutesHeadlessBrowser(Signature): | ||
| name = "executes_headless_browser" | ||
| description = "Executed a web browser in headless mode, possibly for C2 or evasion" | ||
| severity = 3 | ||
| confidence = 80 | ||
| categories = ["command", "evasion", "c2"] | ||
| authors = ["Kevin Ross"] | ||
| minimum = "1.3" | ||
| evented = True | ||
| ttps = ["T1202", "T1564"] | ||
| mbcs = ["OB0009"] | ||
|
|
||
| def run(self): | ||
| ret = False | ||
| browsers = [ | ||
| r"chrome\.exe", | ||
| r"brave\.exe", | ||
| r"opera\.exe", | ||
| r"vivaldi\.exe", | ||
| r"msedge\.exe", | ||
| r"firefox\.exe" | ||
| ] | ||
| headless_flags = [ | ||
| r"--headless", | ||
| r"-headless" | ||
| ] | ||
| # Compile regexes for performance (Ignore Case) | ||
| browser_regex = re.compile(r'(?:' + '|'.join(browsers) + r')', re.IGNORECASE) | ||
| headless_regex = re.compile(r'(?:' + '|'.join(headless_flags) + r')', re.IGNORECASE) | ||
|
|
||
| # Whitelist for known legitimate headless processes | ||
| whitelist = [ | ||
| # Example: r"c:\\sandbox\\internal_tools\\legit_scraper\.py" | ||
| ] | ||
|
|
||
| for cmdline in self.results.get("behavior", {}).get("summary", {}).get("executed_commands", []): | ||
| lower_cmdline = cmdline.lower() | ||
|
|
||
| if browser_regex.search(lower_cmdline): | ||
| if headless_regex.search(lower_cmdline): | ||
| is_whitelisted = any(re.search(w, lower_cmdline) for w in whitelist) | ||
|
|
||
| if not is_whitelisted: | ||
| ret = True | ||
| self.data.append({"command": cmdline}) | ||
|
|
||
| return ret |
There was a problem hiding this comment.
For performance, it's better to compile regular expressions only once when the class is defined, rather than on every call to run(). You can achieve this by defining browsers, headless_flags, and the compiled regexes as class attributes.
This change also allows for simplifying the run method by consistently using re.IGNORECASE for case-insensitive matching and removing the redundant .lower() call. The whitelist check is also updated to be case-insensitive.
class ExecutesHeadlessBrowser(Signature):
name = "executes_headless_browser"
description = "Executed a web browser in headless mode, possibly for C2 or evasion"
severity = 3
confidence = 80
categories = ["command", "evasion", "c2"]
authors = ["Kevin Ross"]
minimum = "1.3"
evented = True
ttps = ["T1202", "T1564"]
mbcs = ["OB0009"]
browsers = [
r"chrome\.exe",
r"brave\.exe",
r"opera\.exe",
r"vivaldi\.exe",
r"msedge\.exe",
r"firefox\.exe",
]
headless_flags = [r"--headless", r"-headless"]
browser_regex = re.compile(r"(?:" + "|".join(browsers) + r")", re.IGNORECASE)
headless_regex = re.compile(r"(?:" + "|".join(headless_flags) + r")", re.IGNORECASE)
def run(self):
ret = False
# Whitelist for known legitimate headless processes
whitelist = [
# Example: r"c:\\sandbox\\internal_tools\\legit_scraper\.py"
]
for cmdline in self.results.get("behavior", {}).get("summary", {}).get("executed_commands", []):
if self.browser_regex.search(cmdline):
if self.headless_regex.search(cmdline):
is_whitelisted = any(re.search(w, cmdline, re.IGNORECASE) for w in whitelist)
if not is_whitelisted:
ret = True
self.data.append({"command": cmdline})
return ret| minimum = "1.3" | ||
| evented = True | ||
| ttps = ["T1202", "T1564"] | ||
| mbcs = ["OB0009"] |
There was a problem hiding this comment.
There appears to be a typo in the MBC code. It's specified as OB0009, but based on data/mbc.json, it should likely be B0009. You might also consider a more specific sub-behavior like B0009.012 (Human User Check), as headless browser execution is a strong indicator of no interactive user.
mbcs = ["B0009"]| class SuspiciousBrowserArguments(Signature): | ||
| name = "suspicious_browser_arguments" | ||
| description = "Executed a browser with suspicious arguments" | ||
| severity = 2 | ||
| confidence = 80 | ||
| categories = ["command", "evasion", "stealth", "defense_evasion"] | ||
| authors = ["Kevin Ross"] | ||
| minimum = "1.3" | ||
| evented = True | ||
| ttps = ["T1562", "T1564", "T1218"] | ||
|
|
||
| def run(self): | ||
| ret = False | ||
|
|
||
| # Target Web Browsers | ||
| browsers = [ | ||
| r"chrome\.exe", | ||
| r"brave\.exe", | ||
| r"opera\.exe", | ||
| r"vivaldi\.exe", | ||
| r"msedge\.exe", | ||
| r"firefox\.exe" | ||
| ] | ||
|
|
||
| suspicious_flags = { | ||
| "security_bypass": [ | ||
| r"--no-sandbox", # Disables the browser's core security sandbox | ||
| r"--disable-web-security", # Disables Same-Origin Policy (SOP) | ||
| r"--ignore-certificate-errors", # Allows interception/MitM of HTTPS traffic | ||
| r"--allow-running-insecure-content",# Bypasses mixed content warnings | ||
| r"--disable-features=.*isolateorigins" # Disables site isolation | ||
| ], | ||
| "remote_control": [ | ||
| r"--remote-debugging-port", # Opens the Chrome DevTools Protocol (CDP) for remote C2 | ||
| r"--remote-allow-origins", # Allows external scripts to connect to the CDP | ||
| r"--enable-automation" # Used by Puppeteer/Selenium, suppresses some UI warnings | ||
| ], | ||
| "stealth_and_evasion": [ | ||
| r"--window-position=-\d+", # e.g., --window-position=-32000 (Moves window off-screen) | ||
| r"--mute-audio", # Prevents ad/video audio from alerting the user | ||
| r"--disable-crash-reporter", # Prevents Windows from catching browser crashes | ||
| r"--disable-notifications", # Suppresses push notifications | ||
| r"--hide-scrollbars", # UI hiding | ||
| r"--no-first-run" # Bypasses the initial setup prompts | ||
| ] | ||
| } | ||
|
|
||
| browser_regex = re.compile(r'(?:' + '|'.join(browsers) + r')', re.IGNORECASE) | ||
| compiled_flags = {} | ||
| for category, flags in suspicious_flags.items(): | ||
| compiled_flags[category] = re.compile(r'(?:' + '|'.join(flags) + r')', re.IGNORECASE) | ||
|
|
||
| # Whitelist for known legitimate automated processes | ||
| whitelist = [ | ||
| # Example: r"c:\\sandbox\\internal_tools\\legit_scraper\.py" | ||
| ] | ||
|
|
||
| for cmdline in self.results.get("behavior", {}).get("summary", {}).get("executed_commands", []): | ||
| lower_cmdline = cmdline.lower() | ||
|
|
||
| if browser_regex.search(lower_cmdline): | ||
| is_whitelisted = any(re.search(w, lower_cmdline) for w in whitelist) | ||
| if is_whitelisted: | ||
| continue | ||
|
|
||
| detected_categories = [] | ||
| for category, regex in compiled_flags.items(): | ||
| if regex.search(lower_cmdline): | ||
| detected_categories.append(category) | ||
|
|
||
| if detected_categories: | ||
| ret = True | ||
| self.data.append({ | ||
| "command": cmdline, | ||
| "flagged_categories": detected_categories | ||
| }) | ||
|
|
||
| return ret |
There was a problem hiding this comment.
To improve performance, it's better to compile regular expressions only once when the class is defined, instead of inside the run() method. You can move browsers, suspicious_flags, and the compiled regexes to be class attributes.
This refactoring also provides an opportunity to clean up the logic by consistently using re.IGNORECASE for case-insensitive matching and removing the redundant .lower() call. The whitelist check is also updated to be case-insensitive.
class SuspiciousBrowserArguments(Signature):
name = "suspicious_browser_arguments"
description = "Executes a browser with suspicious arguments"
severity = 2
confidence = 80
categories = ["command", "evasion", "stealth", "defense_evasion"]
authors = ["Kevin Ross"]
minimum = "1.3"
evented = True
ttps = ["T1562", "T1564", "T1218"]
browsers = [
r"chrome\.exe",
r"brave\.exe",
r"opera\.exe",
r"vivaldi\.exe",
r"msedge\.exe",
r"firefox\.exe",
]
browser_regex = re.compile(r"(?:" + "|".join(browsers) + r")", re.IGNORECASE)
suspicious_flags = {
"security_bypass": [
r"--no-sandbox", # Disables the browser's core security sandbox
r"--disable-web-security", # Disables Same-Origin Policy (SOP)
r"--ignore-certificate-errors", # Allows interception/MitM of HTTPS traffic
r"--allow-running-insecure-content", # Bypasses mixed content warnings
r"--disable-features=.*isolateorigins", # Disables site isolation
],
"remote_control": [
r"--remote-debugging-port", # Opens the Chrome DevTools Protocol (CDP) for remote C2
r"--remote-allow-origins", # Allows external scripts to connect to the CDP
r"--enable-automation", # Used by Puppeteer/Selenium, suppresses some UI warnings
],
"stealth_and_evasion": [
r"--window-position=-\d+", # e.g., --window-position=-32000 (Moves window off-screen)
r"--mute-audio", # Prevents ad/video audio from alerting the user
r"--disable-crash-reporter", # Prevents Windows from catching browser crashes
r"--disable-notifications", # Suppresses push notifications
r"--hide-scrollbars", # UI hiding
r"--no-first-run", # Bypasses the initial setup prompts
],
}
compiled_flags = {
category: re.compile(r"(?:" + "|".join(flags) + r")", re.IGNORECASE)
for category, flags in suspicious_flags.items()
}
def run(self):
ret = False
# Whitelist for known legitimate automated processes
whitelist = [
# Example: r"c:\\sandbox\\internal_tools\\legit_scraper\.py"
]
for cmdline in self.results.get("behavior", {}).get("summary", {}).get("executed_commands", []):
if self.browser_regex.search(cmdline):
is_whitelisted = any(re.search(w, cmdline, re.IGNORECASE) for w in whitelist)
if is_whitelisted:
continue
detected_categories = []
for category, regex in self.compiled_flags.items():
if regex.search(cmdline):
detected_categories.append(category)
if detected_categories:
ret = True
self.data.append({"command": cmdline, "flagged_categories": detected_categories})
return ret1 participant
Added signatures to detect headless browser execution and suspicious browser arguments. This is seen in various Russian APT activity (https://lab52.io/blog/drillapp-new-backdoor-targeting-ukrainian-entities-with-possible-links-to-laundry-bear/, https://www.splunk.com/en_us/blog/security/mockbin-and-the-art-of-deception-tracing-adversaries-going-headless-and-mocking-apis.html).
DRILLAPP e20831cecd763d0dc91fb39f3bd61d17002608c5a40a6cf0bd16111f4e50d341
