Chrome - Known Malware Downloaded

This rule alerts on dangerous file download.

Details

ID	`8c9024e2-3d25-471a-a7de-938335c1a38d`
From Version	8.4.0
Execution Mode	REAL_TIME
Dataset	alerts

MITRE ATT&CK

TA0002 - Execution
- T1204.002 - User Execution: Malicious File

XQL Query

datamodel dataset = google_workspace_chrome_raw 
| filter xdm.event.type = "MALWARE_TRANSFER" and xdm.observer.action = "BYPASSED"
| fields xdm.event.type, xdm.event.description, xdm.observer.action, xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username, xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser, xdm.network.http.url, xdm.source.user_agent, xdm.target.file.filename, xdm.target.file.size

Investigation Query

datamodel dataset = google_workspace_chrome_raw 
| filter xdm.event.type = "MALWARE_TRANSFER" and xdm.observer.action = "BYPASSED"
| filter xdm.source.user.username = $xdm.source.user.username and xdm.source.host.hostname = $xdm.source.host.hostname and xdm.intermediate.user.username = $xdm.intermediate.user.username and xdm.target.file.filename = $xdm.target.file.filename

Source

GoogleChrome_-_Known_Malware_Downloaded.yml

Download History Raw

alert_category: EXECUTION
alert_description: User $xdm.source.user.username downloaded the file $xdm.target.file.filename
  via chrome profile $$xdm.intermediate.user.username on $xdm.source.host.hostname.
alert_fields:
  action_file_name: xdm.target.file.filename
  actor_effective_username: xdm.source.user.username
  agent_hostname: xdm.source.host.hostname
  fw_url_domain: xdm.network.http.url
  user_agent: xdm.source.user_agent
alert_name: Chrome - Known Malware Downloaded
crontab: null
dataset: alerts
description: This rule alerts on dangerous file download.
drilldown_query_timeframe: ALERT
execution_mode: REAL_TIME
global_rule_id: 8c9024e2-3d25-471a-a7de-938335c1a38d
investigation_query_link: "datamodel dataset = google_workspace_chrome_raw \n| filter xdm.event.type = \"\
  MALWARE_TRANSFER\" and xdm.observer.action = \"BYPASSED\"\n| filter xdm.source.user.username\
  \ = $xdm.source.user.username and xdm.source.host.hostname = $xdm.source.host.hostname\
  \ and xdm.intermediate.user.username = $xdm.intermediate.user.username and xdm.target.file.filename\
  \ = $xdm.target.file.filename"
mapping_strategy: CUSTOM
mitre_defs:
  TA0002 - Execution:
  - 'T1204.002 - User Execution: Malicious File'
name: Chrome - Known Malware Downloaded
search_window: null
severity: SEV_030_MEDIUM
suppression_duration: 1 hours
suppression_enabled: true
suppression_fields: xdm.target.file.filename|xdm.source.user.username|xdm.source.host.hostname|xdm.intermediate.user.username
user_defined_category: null
user_defined_severity: null
xql_query: "datamodel dataset = google_workspace_chrome_raw \n| filter xdm.event.type = \"MALWARE_TRANSFER\" and xdm.observer.action\
  \ = \"BYPASSED\"\n| fields xdm.event.type, xdm.event.description, xdm.observer.action,\
  \ xdm.event.outcome_reason, xdm.source.user.username, xdm.intermediate.user.username,\
  \ xdm.source.host.hostname, xdm.source.host.os, xdm.source.host.os_family, xdm.network.http.browser,\
  \ xdm.network.http.url, xdm.source.user_agent, xdm.target.file.filename, xdm.target.file.size"
fromversion: 8.4.0