Browser Fingerprint is ATT&CK T1036.012, a Stealth technique for Linux, macOS and Windows. Adversaries spoof browser and system attributes such as the operating system, language, platform, user-agent string, resolution and time zone, so their web traffic blends in with legitimate traffic.
How attackers use it
MITRE points out that the HTTP User-Agent header is a string that lets servers and network peers identify the application, operating system, vendor and version of the requesting client. An adversary may collect these details through system information discovery, or from users visiting adversary-controlled sites, and then shape their web traffic to match.
Procedure examples on the page: one malware family mimicked a compromised user's traffic by using the same user agent as the installed browser, another used hard-coded user agent strings, and a third mimicked a Chrome browser with a fixed user agent string.
How to detect it
The MITRE analytics describe the same signal on each platform: a process with no graphical context makes HTTP requests with a browser-style user agent. Examples include powershell.exe and wscript.exe on Windows, curl, wget or Python requests on Linux after an interactive shell or from a scheduled job, and osascript, curl or Python on macOS launched by non-interactive agents or background daemons. The tell is that no real browser such as msedge.exe is active or in the parent lineage, or that the user agent deviates from your enterprise baselines.
Put differently, join two sources: network or proxy logs that carry the user agent, and endpoint logs that tell you which process made the connection. A browser user agent from a process that is not a browser is the finding.
How to reduce the risk
MITRE lists one mitigation, audit: review and limit the fingerprinting surface of each browser to the information that is needed, which makes the browser less unique. For example, limit the available fonts to a standard list. On the defender side, keep a baseline of the user agents in your environment and alert on new ones.
