Chrome - User Phished and/or Password Re-use/Breach event

This rule alerts on events related to bad navigation via social engineering or password reuse/breach, that resulted in bypass action.

Google Chrome MEDIUM INFILTRATION

Details

ID	`5e5feef6-08b3-482d-940f-9303ac6bee2d`
From Version	8.4.0
Execution Mode	REAL_TIME
Dataset	alerts

MITRE ATT&CK

TA0001 - Initial Access
- T1566 - Phishing
- T1078 - Valid Accounts

XQL Query

datamodel dataset = google_workspace_chrome_raw 
| filter (xdm.event.type in ("UNSAFE_SITE_VISIT") and xdm.observer.action = "BYPASSED" and xdm.event.description contains "SOCIAL_ENGINEERING") or (xdm.event.type in ("PASSWORD_BREACH", "PASSWORD_REUSE"))
| fields xdm.event.type, xdm.event.description, xdm.observer.action, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.network.http.url, xdm.source.user_agent, xdm.target.file.filename, xdm.target.file.size

Investigation Query

datamodel dataset = google_workspace_chrome_raw 
| filter (xdm.event.type in ("UNSAFE_SITE_VISIT") and xdm.observer.action = "BYPASSED" and xdm.event.description contains "SOCIAL_ENGINEERING") or (xdm.event.type in ("PASSWORD_BREACH", "PASSWORD_REUSE"))
| filter xdm.source.user.username = $xdm.source.user.username and xdm.intermediate.user.username = $xdm.intermediate.user.username and xdm.source.host.hostname = $xdm.source.host.hostname

Source

GoogleChrome_-_User_Phished_or_Password_Re-useorBreach_event.yml

Download History Raw

alert_category: INFILTRATION
alert_description: The user $xdm.source.user.username had $xdm.event.type event
  via $xdm.intermediate.user.username chrome profile, which resulted in $xdm.observer.action.
alert_fields:
  action_file_name: xdm.target.file.filename
  actor_effective_username: xdm.source.user.username
  agent_hostname: xdm.source.host.hostname
  fw_url_domain: xdm.network.http.url
  user_agent: xdm.source.user_agent
alert_name: Chrome - User Phished and/or Password Re-use/Breach event
crontab: null
dataset: alerts
description: This rule alerts on events related to bad navigation via social engineering
  or password reuse/breach, that resulted in bypass action.
drilldown_query_timeframe: ALERT
execution_mode: REAL_TIME
global_rule_id: 5e5feef6-08b3-482d-940f-9303ac6bee2d
investigation_query_link: "datamodel dataset = google_workspace_chrome_raw \n| filter (xdm.event.type in\
  \ (\"UNSAFE_SITE_VISIT\") and xdm.observer.action = \"BYPASSED\" and xdm.event.description\
  \ contains \"SOCIAL_ENGINEERING\") or (xdm.event.type in (\"PASSWORD_BREACH\"\
  , \"PASSWORD_REUSE\"))\n| filter xdm.source.user.username = $xdm.source.user.username\
  \ and xdm.intermediate.user.username = $xdm.intermediate.user.username and xdm.source.host.hostname\
  \ = $xdm.source.host.hostname"
mapping_strategy: CUSTOM
mitre_defs:
  TA0001 - Initial Access:
  - T1566 - Phishing
  - T1078 - Valid Accounts
name: Chrome - User Phished and/or Password Re-use/Breach event
search_window: null
severity: SEV_030_MEDIUM
suppression_duration: 1 hours
suppression_enabled: true
suppression_fields: xdm.source.host.hostname|xdm.source.user.username|xdm.intermediate.user.username|xdm.event.type|xdm.network.http.url
user_defined_category: null
user_defined_severity: null
xql_query: "datamodel dataset = google_workspace_chrome_raw \n| filter (xdm.event.type in (\"UNSAFE_SITE_VISIT\")\
  \ and xdm.observer.action = \"BYPASSED\" and xdm.event.description contains \"\
  SOCIAL_ENGINEERING\") or (xdm.event.type in (\"PASSWORD_BREACH\", \"PASSWORD_REUSE\"\
  ))\n| fields xdm.event.type, xdm.event.description, xdm.observer.action, xdm.event.outcome_reason,\
  \ xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname,\
  \ xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.network.http.url,\
  \ xdm.source.user_agent, xdm.target.file.filename, xdm.target.file.size"
fromversion: 8.4.0